I don't understand how Splunk does regex!
I have this search below:
...
| spath output=test path=a.b.c
| rex field=test "?[0-9]+"
| table test, test1
Test is this: `{"timehours":"16","timeminutes":"34","timeseconds":"11"}`
How do I extract just the numbers and semicolon except the first semicolon?
Thanks!
↧