Please help me with regular expression
i want to extract a1234567
"INDV=1234566|RSPAR|a1234567|RSPAR"
hi sravankaripe,
you can use it on row events
\d+\|\w+\|(?<your_field>[^\|]*)
or using a rex command
| rex field=INDV "\d+\|\w+\|(?<your_field>[^\|]*)"
You can see it at https://regex101.com/r/Ve484u/1
Bye.
Giuseppe
I would consider using the split
and mvindex
commands for this, assuming INDV is being extracted already:
... | eval my_field=mvindex(split(INDV,"|"),2)
With regex:
... | rex field=INDV "RSPAR\|(?[^|]+)"
But that really depends on the consistency of the data around your target extraction.
hi sravankaripe,
you can use it on row events
\d+\|\w+\|(?<your_field>[^\|]*)
or using a rex command
| rex field=INDV "\d+\|\w+\|(?<your_field>[^\|]*)"
You can see it at https://regex101.com/r/Ve484u/1
Bye.
Giuseppe
| rex field=_raw "\d+|\w+|(?[^|]*)"
this worked for me Thanks