Hello
I have a source path which from I want to extract 2 parts, each part to a different field
this is the path :
/splunkdev/copyFilesAmerFDM.log
I want to extract "Amer" (can be anything, just always will be after "copyFiles"
and FDM (also can be anything will be always before .log)
this is what i came to but it is not working:
| rex field=source \/splunkdev\/copyFiles(?<Region>\w+)
Thanks
Try this:
|rex field=source "\/splunkdev\/copyFiles(?<Region>[A-Z]{2}|[A-Z][a-z]+)(?<Field>[a-zA-Z]*)\.log"
Try this:
|rex field=source "\/splunkdev\/copyFiles(?<Region>[A-Z]{2}|[A-Z][a-z]+)(?<Field>[a-zA-Z]*)\.log"
perfect! thanks
Please try
| rex field=source "\/copyFiles(?<Region>[A-Za-z]+))"
example in https://regex101.com/r/ae5Xyg/1
If you want to Split FDM Part, then
| rex field=source "\/copyFiles(?<Region>[A-Za-z]+)(?<fdmField>FDM).log"
Hi @sarit_s,
Try this one to capture everything and to stop right before the FDM
:
| rex field=source "\/copyFiles(?<Region>[A-Z][a-z]+)"
Cheers,
David
thanks David
it is catching only Amer, but if i have Region looks li "SA" for example it is not taking it
also, how can i take the FDM part ?