How to filter out some information with XQL

[Pattarachai-FTH]

Hi Expert  ,

I want to filter out some info from dataset such as " message:111.111.111.11"  I want to filter just  IP-address with regex and remove "message:"   how to filter it  on XQL 

Thank you 

[PiyushKohli · Accepted solution]

Hi @Pattarachai-FTH 

Thank you for writing to live community!

Since you want to extract IP only then one way you may achieve it by using regextract.  Assuming the field name as "log" in which you have this value i.e. " message:111.111.111.11".  Then using below way you may extract the IP. 

dataset=xyz

 | alter IP = regextract(log, "(\d+\.\d+\.\d+\.\d+)")

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Thanks