I have various search string under the field name entity:
Entity
1 ABC:BOOT2NDSUNQTR_MAINT4_sfsdfdsfsdf
2 FSD:BOOT2NDSUNMONTH_MAINT3_erewrewre
3 AFE:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_sdfsdfdsf
and so on..
I want field such as BOOT2NDSUNQTR,BOOT2NDSUNMONTH_MAINT3 to be separated out and put it into a different field called jobname.Can you please help me in writing the regex for the same
Hi
Try this
| makeresults
| eval test="ABC:BOOT2NDSUNQTR_MAINT4_sfsdfdsfsdf,FSD:BOOT2NDSUNMONTH_MAINT3_erewrewre,AFE:BOOTALLSUNMONTH_MAINT1_SecProd_DEV_sdfsdfdsf"
| makemv test delim=","
| mvexpand test
| rex field=test "\:(?P<test>[\S]+)"
| eval result=split(test,"_")
| eval jobName =mvindex(result,0)."_".mvindex(result,1)
| table jobName
@mayank101 See example below
| makeresults |eval Entity=" ABC:BOOT2NDSUNQTR_MAINT4_sfsdfdsfsdf"| rex field=Entity "(?<jobname>\S+_\S+)_"