Below is my query which list about 80 events grouped by a certain ID (488e5185-42d7-4eec-bcb5-43590ae751a0).
The events have different field names for the same ID (ASAPLocateID, TransID, locate, clientLocateId domain="GLR">488e5185-42d7-4eec-bcb5-43590ae751a0</ns0:clientLocateId). How can I extract this ID and any others into a field regardless of the different host, source, or sourcetype?
index="gfs_cft_neo" OR index="gfs_sbl_al" source!="*performance*" "488e5185-42d7-4eec-bcb5-43590ae751a0"| reverse | streamstats window=1 global=f current=t first(source) as p_source count as Transition | eval transition_time = if(p_source == source, _time, -1 ) | where transition_time > -1 | streamstats count as Transition | delta transition_time AS transition_duration | rex field=source ".*/(?<Component>.*).log"| table Transition, Component, transition_duration
With the coalesce
command, like this:
index="gfs_cft_neo" OR index="gfs_sbl_al" source!="performance" "488e5185-42d7-4eec-bcb5-43590ae751a0"| eval NormalizedID=coalesce(ASAPLocateID, TransID, locate, clientLocateId)
Then you do your downstream work with NormalizedID
.
With the coalesce
command, like this:
index="gfs_cft_neo" OR index="gfs_sbl_al" source!="performance" "488e5185-42d7-4eec-bcb5-43590ae751a0"| eval NormalizedID=coalesce(ASAPLocateID, TransID, locate, clientLocateId)
Then you do your downstream work with NormalizedID
.