LIVEcommunity - Who rated this post

Here is a simple query to extract the fourth character while ignoring dashes if found, also added another field "Group Status" for more convenient classification

dataset = xdr_data 
| filter agent_hostname != null
| fields agent_hostname 
| alter fouth_letter_array = regextract(agent_hostname , "(?i)(?:[^A-Za-z]*[A-Za-z]){3}[^A-Za-z]*([A-Za-z])")
| alter fourth_letter = arrayindex(fouth_letter_array,0)
| alter Group_Status = 
    if(fourth_letter ="P",  "Prod", 
       fourth_letter ="T",  "Test", // add more 
       fourth_letter)  // return as is if no match
| fields agent_hostname, Group_Status

Who rated this post

L1 Bithead

Rating date:

Unlock your full community experience!

Who rated this post