Below is an example from an access.log that I am trying to extract the productList from. The number of products numbers change for each request. i.e. some may have 1 product number some may have 5. I need some help in extracting the productList separately.
2013-12-31 12:30:53 0.0010 0 - 204.107.141.40 GET /open-sounthing/compete.html?pagename=myco:getsomething:page7:goodjob&differentinfo=someinfo&productList=4004,4102,4107 200
I would like to be able to pull out the productList and rename them by number to use in pivot
4004= corn
4102= viper
4107= dog
This would get you a multivalue field with the three productIds:
... | rex "productList=(?<productId>(\d+,?)+)" | makemv productId delim=","
This would get you a multivalue field with the three productIds:
... | rex "productList=(?<productId>(\d+,?)+)" | makemv productId delim=","
Then you can have lookup file containing productId and productionName and do a lookup to get productName into your result.
...@martin's search | lookup productiondetail.csv productId OUTPUT productName
Thanks that worked