I have the following syslog
Jan 30 14:34:05 10.234.150.21 Jan 30 13:34:05 DEN-COLO-VBN-CTRL-01 stm[10699]: <305007>
I am trying to extract "John Smith" as the username. The closest I have gotten so far:
(?:[^-\n]*-){8}\d+\s+\d+.\d+.\d+.\d+>\s+\w+\s+(?P
which extracts "John" as the First Name and "Smith" as the last name. Can I concatenate the two somehow? Also having the username as "Smith, John" would work as well.
Any thoughts?
You can use an eval command to create a new field:
| eval fullname= fieldname1 . " " . fieldname2
That'll create a field called fullname that's = "John Smith"
Brian
Thanks Brian,
That's very cool. Ideally I would like to have this extracted into a single field at search time so I don't have to eval it as part of the search.