find the number of inner elements from parse string

Follow

Satya Prakash

• July 16, 2018 13:23

Ex:

if i have a string as "choco:[abc,bdc,efh]" or "choco:[abc]" in my logs ,i need to find the number of elements between [].Here the first serach has 3 words between [...] and second time i have only one abc.

0

• 

  Monty Yao

  • July 23, 2018 18:40

  You could parse out the elements within choco with regex multi, then count how many time it shows. For example:

   

  | parse "*:[*]" as name,elements
  | extract field=inner "(?<comma>\,+?)" multi  // extract the comma characters
  | count name  // this count how many time choco shows up 
  | _count+1 as num_elements  // add one because number of elements is one more than number of commas

  0

  Comment actions Permalink

Please sign in to leave a comment.