Hi
I would like to pull a string out from a field of a variable length, where the length is defined by index_of("string2") - index_of("string1"), that is the field looks like this "some stuff string1 string string2"
I've tried doing it like this SUBSTR(field, INDEX_OF('string1'), INDEX_OF('string2') - INDEX_OF('string1'))
but logparser is refusing to accept this, and it is the "algebraic" part that is the problem.
Does anyone have any ideas to solve this.
Regards Daniel.