Hi,
I am trying to create a new field "foo" whose content is generated from field "bar", depending on the content of field "bar".
The condition is, if the value "bla" is contained in field "bar", then set the value for "foo" to [rex field=bar "(\ w +) . \ W + $"], otherwise set the value to [rex field=bar "(\ w +) . \ w + $"].
Values from field "bar" looks like:
oud.common.comp.core.nightling.bla
common.comp.core.nightling.protocol
loud.bam.comp.client.news.thrift
oud.bam.comp.client.files.thrift
The values for field "foo" should look like:
bla
nightling
news
files
I tried to set it up with the following search:
... | eval foo=if(match(bar,"bla"),rex field=bar (\w+)\.\w+$],[rex field=bar (\w+)\.\w+$]
The result is:
Error in 'rex' command: The regex '(\w+)\.\w+$' does not extract anything. It should specify at least one named group. Format: (?<name>...).
It would be nice if someone could help me to find the solution, that it will work.
Thanks in advanced
... View more