Yes, I need to extract the string with length based on the digits before that. But as per the following query,
|makeresults|eval _raw="07PRIVATEStationSt1256"|rex "(?\d{2})(?\w+)(?\w+)(?\d{3})"| eval MyString=substr(MyString,1,StringLength)
the modifier MyString will take " PRIVATEStationSt1256 " and take the substring of length 07 from the original MyString value. I mean, since the taking the substring after the rex command causes the error. This is wrong.
Because, If the MyString value extracts " PRIVATEStationSt1256 " , then the value for StationName and StationId will be empty.
I hope you understand what is the issue here.
... View more