Would like to do this:
Where indexa has two fields, md5 and allmd5
Two records exist like this:
md5=99ed710da1d10b1cf8c4fb7c2549a9dc
allmd5={"MD5":"99ed710da1d10b1cf8c4fb7c2549a9dc". MD5:"6ac349a75ff9e7cbc92cd68c5fc44eed", "MD5":"8ca9e5e0a7cdb058f6f33f60a2fde2ef"}
md5=45c4a725006767124e21242670e7795f
allmd5={"MD5":"99ed710da1d10b1cf8c4fb7c2549a9dc". MD5:"6ac349a75ff9e7cbc92cd68c5fc44eed", "MD5":"8ca9e5e0a7cdb058f6f33f60a2fde2ef"}
I've tried:
index=indexa | regex allmd5!=md5
and
index=indexa | regex allmd5!="\"".md5."\""
Tried it with eval
too
but it always returns all records where it should just return the case where the value of md5 for that record is NOT in the allmd5 value.
What am I missing?
Can you try this simply:
yourBaseSearch to return md5 and allmd5
| eval matched=if(match(allmd5, md5), 1, 0)
| table md5, allmd5, matched
| where matched=0
Can you try this simply:
yourBaseSearch to return md5 and allmd5
| eval matched=if(match(allmd5, md5), 1, 0)
| table md5, allmd5, matched
| where matched=0
worked perfectly, thank you!
| makeresults | eval data="md5=99ed710da1d10b1cf8c4fb7c2549a9dc#allmd5={\"MD5\":\"99ed710da1d10b1cf8c4fb7c2549a9dc\". MD5:\"6ac349a75ff9e7cbc92cd68c5fc44eed\", \"MD5\":\"8ca9e5e0a7cdb058f6f33f60a2fde2ef\"}%md5=45c4a725006767124e21242670e7795f#allmd5={\"MD5\":\"99ed710da1d10b1cf8c4fb7c2549a9dc\". MD5:\"6ac349a75ff9e7cbc92cd68c5fc44eed\", \"MD5\":\"8ca9e5e0a7cdb058f6f33f60a2fde2ef\"}\"" | rex max_match=0 field=data "(?<line>[^%]+)" | mvexpand line | rex field=line "md5=(?<md5>[^#]+)#allmd5=(?<allmd5>[^#]+)" | table md5 allmd5 | where NOT match(allmd5, md5)