Hi experts,
please help me with regular expression to match the value in each event at search time as shown below
:{\"buaid\":{\"business\":[\"12345\"],\"exclude*
required output: bss_value=12345
thanks in advance.
|rex "(?<bss_value>\d{5})"
This is enough.
This might get you close, with a run anywhere example:
| makeresults | eval _raw=":{\\\"buaid\\\":{\\\"business\\\":[\\\"12345\\\"],\\\"exclude*"
| rex ":{\\\\\"buaid\\\\\":{\\\\\"business\\\\\":\[\\\\\"(?<bss_value>[^\\\]+)\\\\\"\],"
It sets up a _raw
field, and then extracts from it. The last line should do it for you.
Hi @jpolvino , thanks for the answer. its working fine. but if i have multiple values with ,
separated than its not working .Please help on this.
Ex: :{\"buaid\":{\"business\":[\"12345\",\"6789\"]
Try
business\\":\[\\"(?<bss_value>[^\\]+)\\