help with regex needed

[damucka]

Hello,

I have the following content in the variable $result.LINE$ in my alert, coming as a DB SQL result:

Below workload classes were created after the last anomaly: I306668 D041875 I355581 I327556 I027931 C5279166 I330801 I506540 I829697 I842940 I843132 I865403 I001314 I309296 I520545 D066638 I506897 I340509 I829186 D040915 D057879 I007374 D054254 D048889 I802644 C5243636 I041661 D020525 I500011 I310846 I307944 I511708 I318767 I317172 I019343 I310161 I335757 I345544 I519010 I520636

Now, this is one line, however, I would like to present it in the alert e-mail like this:

 Below workload classes were created after the last anomaly: 
 I306668 
 D041875 
 I355581
  ...

I thought I would just apply some regex to the $result.LINE$which would replace the whitespaces after the ":" with the \n, but after trying with regex101 a little bit I am not much smarter.
Could you please advise how the corresponding regex would look like?

Kind Regards,
Kamil

[gcusello · Accepted solution]

Hi @damucka,
please try something like this:

| makeresults | eval _raw=" Below workload classes were created after the last anomaly: I306668 D041875 I355581 I327556 I027931 C5279166 I330801 I506540 I829697 I842940 I843132 I865403 I001314 I309296 I520545 D066638 I506897 I340509 I829186 D040915 D057879 I007374 D054254 D048889 I802644 C5243636 I041661 D020525 I500011 I310846 I307944 I511708 I318767 I317172 I019343 I310161 I335757 I345544 I519010 I520636"
| rex field=_raw "Below workload classes were created after the last anomaly: (?<codes>.*)"
| makemv codes
| mvexpand codes
| table codes
| rename codes As "Below workload classes were created after the last anomaly:"

Ciao.
Giuseppe

[damucka]

Hi Giuseppe,

I am not sure if this is going to work for me.
The point is, that I really need to have the result at the end in the $result.LINE$ variable. The issue with your example is that you create the table, which wipes out all other variables that I have. I did not mention it in my question in order to keep it simple. So at the end I guess I really need a regex here.

Kind Regards,
Kamil

[gcusello]

Hi @damucka,
I never experienced this field, but if you want to have the list of the values in your email, you can use this search:

| makeresults 
| eval _raw=" Below workload classes were created after the last anomaly: I306668 D041875 I355581 I327556 I027931 C5279166 I330801 I506540 I829697 I842940 I843132 I865403 I001314 I309296 I520545 D066638 I506897 I340509 I829186 D040915 D057879 I007374 D054254 D048889 I802644 C5243636 I041661 D020525 I500011 I310846 I307944 I511708 I318767 I317172 I019343 I310161 I335757 I345544 I519010 I520636"
 | rex field=_raw "Below workload classes were created after the last anomaly: (?<codes>.*)"
 | makemv codes

then you can use in email body $result.codes$.

Ciao.
Giuseppe