Created on 09-09-2019 09:53 AM - last edited on 09-09-2019 10:14 AM by ask_bill_brooks
I have an event {
"a":"avc123.abc.com",
"b":"24 - ny",
"c" : "21321kodi"
}
i would like to use extracttext to filter/extract only the "b" however, it is picking up the first match. How can I specify to extract text from field "b" only not "a" neither "c"
Created 09-09-2019 09:07 PM
Try with this regex
(?:"b"\s*:\s*)"(.*?)",
This will extract only 24 - ny value from the given event
Created 09-09-2019 09:07 PM
Try with this regex
(?:"b"\s*:\s*)"(.*?)",
This will extract only 24 - ny value from the given event
Created 09-10-2019 07:59 AM