Hello,
I have got a question about a Query. This is the query:
index=security-mijnssp "View rendered = /error.jspx" OR "Er is een fout opgetreden op de JSF" | rex "BSN=(?P<BSN>[^<]+) View" | rex "INFO n.s.m.w.l(?P<INFO>[^<]+)"|rex "ERROR n.s.m.w.l(?P<ERROR>[^<]+)"| table BSN, INFO, ERROR, _time
And this is how the table look likes:
My question is how i can put the results in one row? So that BSN, INFO, ERROR and Time are on the same line sorted by Time?
Thanks for the answer!
Look at the documentation for transactions, and use BSN as your transaction identifier.