I'm trying to pull a certain type of data from a field but that field can change into different types of data depending on the log. I only want to keep the particular data and ignore the rest.
An example would be a field called "username". I don't care when username=root but when username="any other user" I want to grab that data only. Is there a way to do this? I appreciate any feedback.
during search time you can use the command "rex" to extract a piece of another field. rex uses regex on top of any data to create new fields (or replace).
|rex field=username "(?<username2>\w+)"
This builds a new field username2 with any username. So same type of concept, since you can use regex, do conditional lookahead matching:
|rex field=username "(?<username2>(?!root)\w+)"
This should match the field only if root is not matched.
Hope that helps.
during search time you can use the command "rex" to extract a piece of another field. rex uses regex on top of any data to create new fields (or replace).
|rex field=username "(?<username2>\w+)"
This builds a new field username2 with any username. So same type of concept, since you can use regex, do conditional lookahead matching:
|rex field=username "(?<username2>(?!root)\w+)"
This should match the field only if root is not matched.
Hope that helps.
Awesome thanks!