I want to extract the string from the string and use it under a field

Question

I want to extract a string from a string...and use it under a field named source.

I tried writing like this bu no good.

index = cba_nemis Status: J source = *AAP_ENC_UX_B.* |eval plan=upper
(substr(source,57,2)) |regex source = "AAP_ENC_UX_B.\w+\d+rp"|stats
count by  plan,source

for example..

source=/p4products/nemis2/filehandlerU/encpr1/log/AAP_ENC_UX_B.az_in_aza_277U_ rp-20190722-054802.log source=/p4products/nemis2/filehandlerU/encpr2/log/AAP_ENC_UX_B.oh_in_ohf_ed_ph_ld-20190723-034121.log

I want to extract the string \ AAP_ENC_UX_B.az_in_aza_277U_ rp from 1st and AAP_ENC_UX_B.oh_in_ohf_ed_ph_ld from 2nd.

and put it under the column source along with the counts..

I want results like...

           source                                   counts
AAP_ENC_UX_B.az_in_aza_277U_ rp                       1
AAP_ENC_UX_B.oh_in_ohf_ed_ph_ld                       1

Answer 1

You can use the [rex][1] command that extracts a new field from an existing field by applying a regular expression.

...search... 
| rex field=source ".+\/(?<source_v2>[\.\w\s]+)-.+"
| stats count by plan, source_v2

Be careful, though: I called the new field source_v2, what you were asking would rewrite the existing source field without you explicitly requesting this. Just change source_v2 to source in my code in case this is what you want.

The search takes this new source_v2 field into account. Try and see if this is what you need. You can tweak it easily to get your expected results.