Finding first occurrence of matching beginning anchor in field extraction.

[Cuyose]

I need to create a regex field extraction to deal with odd events where the same string exists multiple times before my end anchor after same begin anchors.

rough example:

<ExternalErrorDescription>A bunch of random stuff</ExternalErrorDescription><ExternalErrorDescription>more stuff</ExternalErrorDescription><ExternalErrorDescription>WHAT I WANT TO EXTRACT &#xD;

The text between the last <ExternalErrorDescription> and is what I want to extract. The problem is its always grabbing everything as it matches the first <ExternalErrorDescription> up to my end anchor. I can't figure out the syntax to match the last occurance of the beginning string anchor and end anchor.

This is what I have currently

(?i)ExternalErrorDescription>(?P<ExternalErrorDescription>.*?)\&\#xD;

[woodcock · Accepted solution]

Try this:

.*ExternalErrorDescription>(?<ExternalErrorDescription>.*?)\&\#xD;

[Cuyose]

unfortunately this is still matching everything after the first match of

ExternalErrorDescription>

.*ExternalErrorDescription>(?<ExternalErrorDescription>.*?)\&\#xD;

[woodcock]

I tested it on your data and it works; try again:

... | rex  ".*ExternalErrorDescription>(?<ExternalErrorDescription>.*)\&\#xD;" | fields ExternalErrorDescription

[Cuyose]

Interesting, so that does work inline with the search, but I am trying to create a field extraction in settings for this, and it wont work when set the exact same way there. any ideas on how to make that work as a field extraction?

(?i).*ExternalErrorDescription>(?<ExternalErrorDescription>.*)\&\#xD;

[Cuyose]

I got this working, for some reason I had to add a ? in my declaration. The below now works automatically in field extractions.

    (?i).*<ns1:ExternalErrorDescription>(?<ExternalErrorDescription>.*?)\&\#xD;

[woodcock]

Don't forget to "Accept" the answer.