find the number of inner elements from parse string
Ex:
if i have a string as "choco:[abc,bdc,efh]" or "choco:[abc]" in my logs ,i need to find the number of elements between [].Here the first serach has 3 words between [...] and second time i have only one abc.
-
You could parse out the elements within choco with regex multi, then count how many time it shows. For example:
| parse "*:[*]" as name,elements
| extract field=inner "(?<comma>\,+?)" multi // extract the comma characters
| count name // this count how many time choco shows up
| _count+1 as num_elements // add one because number of elements is one more than number of commas
Please sign in to leave a comment.
Comments
1 comment