I have a log:
BL: | LL: INFO | TS: 1234 | AR: RxC_16.00.37.01 | STORE: :BROADCAST |
USER: BROADCAST | HOST: BROADCAST | APPSERVER: rri | MSGID: CINTERFACE
|SC: [Profile] | MSG: ISP Broadcast Received for
I want to get MSGID-SC (CINTERFACE-Profile)
from the string above.
For this i am trying to use rex command:
index=rx_connect "USER: BROADCAST" |rex field=_raw
"MSGID:\s(?<MSGID>[^\|]*)\s\|\SC:\s\[(?<SC>[^\]]*)\]" | eval
someNewField=MSGID."-".SC`
But it is not working. Please suggest further.
Hi kumina
If msgid and sc are not constant , use the max_match option and mvindex command to solve your problem
Try this search code
index=rx_connect "USER: BROADCAST"|rex field=_raw max_match=0 "\|\s\w+\:\s(?P<msgid1>[^\|]+)\s"|eval msgid=mvindex(msgid1,7)
|rex field=_raw "\[(?P<sc>[^\|]+)\]"|rex field=_raw "\|\s(?P<field1>[\w]+)\:\sCINTERFACE"|rex field=_raw "\|(?P<field2>[\w]+)\:\s\[Profile]"|eval someNewField = field1."-".field2." (".msgid."-".sc.")"
|table msgid sc field1 field2 someNewField
see result
Hi kumina
Try this search code it works well
index=rx_connect "USER: BROADCAST" |rex field=_raw "MSGID:\s(?P<msgid>[^\|]+)\s"|rex field=_raw "SC:\s\[(?P<sc>[^\|]+)\]"|rex field=_raw "\|\s(?P<field1>[\w]+)\:\sCINTERFACE"|rex field=_raw "\|(?P<field2>[\w]+)\:\s\[Profile]"|eval someNewField = field1."-".field2." (".msgid."-".sc.")" |table msgid sc field1 field2 someNewField
Look at the following screen capture
Thanks too .
Test the second result and think to vote and accept
Thanks Chimell....
Now it works
Hi,
If value of msgid and sc in above logs is not constant and we want to extract that part then what will be the string
Your regex has a Typo. Try this:
index=rx_connect "USER: BROADCAST" |rex field=_raw "MSGID:\s(?<msgid>[^\|]+)\s\|SC:\s\[(?<sc>[^\]]*)\]" | eval someNewField = msgid."-".sc
Hi,
I am still getting whole logs instead of
MSGID-SC
example:(CINTERFACE-Profile)