I am trying to regex to get a substring
I want substring "addressON" from this string "ThisStreet_addressON_blockb"
here is my query
host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet\_(?<thisStreet>)\_blockb$" | table thisStreet
This is not working
You're almost there. Your name search is missing the capturing regex. Try this
host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet_(?<thisStreet>[^_]+)_blockb$" | table thisStreet
Alternative, try this
host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=mvindex(split(streetName,"_"),1) | table thisStreet
OR
host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=replace(streetName,"ThisStreet_([^ ]*)_blockb$","\1") | table thisStreet
You're almost there. Your name search is missing the capturing regex. Try this
host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet_(?<thisStreet>[^_]+)_blockb$" | table thisStreet
Alternative, try this
host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=mvindex(split(streetName,"_"),1) | table thisStreet
OR
host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | eval thisStreet=replace(streetName,"ThisStreet_([^ ]*)_blockb$","\1") | table thisStreet
For some weird reason only mvindex worked! Thanks!
The other two methods rely on actual string available before and after the thisStreet that you're trying to extract. The regex in 1st and 3rd option is assuming you have a literal string "ThisStreet_" before and "_blockb" after. If they are not static/literal string, then try like this:-
host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "[^_]+_(?<thisStreet>[^_]+)_.+$" | table thisStreet
You forgot the format of your regex:
host = "xyz" | search * streetName!="NULL" | table streetName | dedup streetName | rex field = streetName "ThisStreet\_(?<thisStreet>[^ ]*)\_blockb$" | table thisStreet
in this way you take all chars but no spaces between the underscores.
Eventually try a different one on https://regex101.com/
Bye.
Giuseppe
Try this
| rex (?P<thisStreet>_(\w+)_)