I have a field "dimension" with values:
dimension=InstanceIdentifier=[aaamcehjcdbp01]
dimension=InstanceIdentifier=[aaamcehgcdbp01]......and many more,
I want aaamcehjcdbp01 from this field as new field.
host=aaamcehjcdbp01
host=aaamcehgcdbp01
Please help me with the regex or any other method.
Try below regex-
|rex field=dimension "InstanceIdentifier=\[(?<Name>[^\]]+)"
Below is anywhere run search-
| makeresults |eval dimension="InstanceIdentifier=[aaamcehjcdbp01]"|rex field=dimension "InstanceIdentifier=\[(?<Name>[^\]]+)"
Try below regex-
|rex field=dimension "InstanceIdentifier=\[(?<Name>[^\]]+)"
Below is anywhere run search-
| makeresults |eval dimension="InstanceIdentifier=[aaamcehjcdbp01]"|rex field=dimension "InstanceIdentifier=\[(?<Name>[^\]]+)"
Thanks, it worked