The search result produces output of a column in following format
Element[contractId=true,memberId=<null>,name=[Name [value=true,nameType=NAME]],dateOfBirth=true
Wondering if it is possible to filter the output of these columns to have just the keys and not key=value pairs i.e. have output like
contractId,memberId,name,dateOfBirth
instead of
contractId=true,memberId=<null>,name=[Name[value=true,nameType=NAME]],dateOfBirth=true
Take a look at the rex
command. There are multiple ways you could do it, but here's one:
| rex field=yourfield max_match=50 "(?<key_list>[A-Za-z]+)="
| eval newfield=mvjoin(key_list,",")
You'll end up with the result in the new field key_list
. Skip the second part if you want to keep it as a multi-valued field instead of merging them back into a single entry.
You will need to write a regex that matches your format, or possibly use the xpatch commands. Take a look at the docs for reg and xpath. If you use rex, you may want to try out Kodos or RegexBuddy to help you troubleshoot your regular expression.
How to extract values between Elements tag.