Regex parsing problems

Comments

1 comment

  • Official comment
    Avatar
    Matt Sullivan

    If your sourcecategory has such a predictable pattern, I would avoid regex entirely and just use this:


    | split _sourcecategory delim='/' extract 1 as part1, 2 as part2, 3 as part3, 4 as part4

     

    if you opt to stick with regex, we will only extract the first matching pattern, unless you end with multi keyword, or use two or more capture groups. Multi will duplicate the messages so don't recommend for this use case. A regex that does same as above split would be something like below:

    | parse regex field=_sourcecategory "/?(?<part1>[^/]+)/(?<part2>[^/]+)/(?<part3>[^/]+)/(?<part4>[^/]+)/?"

    Hope this helps.

    Regards,

    Matt

Please sign in to leave a comment.