Parse expression should return all the match results

Comments

3 comments

  • Avatar
    Graham Watts

    Hey Sai,

    Parse Regex Multi can do this, try the below:

    | parse regex "\sname\:(?<field1>abc)" multi

    Hope this helps!

    - Graham

    0
    Comment actions Permalink
  • Avatar
    Graham Watts

    Hey Sai,

    Actually, parse regex multi will show a new line for value instead of field1, field2.

    Usually you will want to use parse regex multi to extract n number of fields, but if you have exactly 2 that you ant you could do this, with the aggregation and transpose to get a table report:

    | parse regex "\sname\:(?<field1>[^\s]+).*name\:(?<field2>[^\s]+)\s"
    | count by field1,field2
    | transpose row field1 column field2


    0
    Comment actions Permalink
  • Avatar
    Sai Gowtham Nambi

    Many Thanks Graham. 

    0
    Comment actions Permalink

Please sign in to leave a comment.