Regex parsing problems


1 comment

  • Official comment
    Matt Sullivan

    If your sourcecategory has such a predictable pattern, I would avoid regex entirely and just use this:

    | split _sourcecategory delim='/' extract 1 as part1, 2 as part2, 3 as part3, 4 as part4


    if you opt to stick with regex, we will only extract the first matching pattern, unless you end with multi keyword, or use two or more capture groups. Multi will duplicate the messages so don't recommend for this use case. A regex that does same as above split would be something like below:

    | parse regex field=_sourcecategory "/?(?<part1>[^/]+)/(?<part2>[^/]+)/(?<part3>[^/]+)/(?<part4>[^/]+)/?"

    Hope this helps.



    Comment actions Permalink

Please sign in to leave a comment.