Hi All
Please help me with rex to filter name by id which start with "9" .
Ex:
Sample log
ContactId:"12345,5678,9999",ContactName:"name1,name2,name3"
Result:
id name
9999 name3
Hi @eduspk
Try the following and let me know
| makeresults
| eval log="ContactId:\"12345,9345,9999\",ContactName:\"name1,name2,name3\""
| rex field=log "ContactId:\"(?P<id>.+)\"\,ContactName\:\"(?P<name>.+)\""
| makemv delim="," id
| makemv delim="," name
| eval temp =mvzip(id,name)
| mvexpand temp
| rex field=temp "(?P<id>\d.+)\,(?P<name>.+)"
| regex id="^9.+"
| table id name
Hi @eduspk
Try the following and let me know
| makeresults
| eval log="ContactId:\"12345,9345,9999\",ContactName:\"name1,name2,name3\""
| rex field=log "ContactId:\"(?P<id>.+)\"\,ContactName\:\"(?P<name>.+)\""
| makemv delim="," id
| makemv delim="," name
| eval temp =mvzip(id,name)
| mvexpand temp
| rex field=temp "(?P<id>\d.+)\,(?P<name>.+)"
| regex id="^9.+"
| table id name
Works fine. Thanks