How to exclude a list of rex fields, then show a stat?
Why does PSAPPSRV and GUEST still show up in the result? How do I exclude them?
sourcetype="psoftapp-appsrv" host="csappprd*"
earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0
NOT (userID=PSAPPSRV OR userID=GUEST )
| rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?[^,]*)"
| bucket _time span=1h
| top limit=2 userID by host, _time
Though the captured name in the rex command got truncated, I'm assuming it was UserID. So, the field didn't exist in the base search (where you added filter NOT (userID=PSAPPSRV OR userID=GUEST )
), hence the filter never took place. In fact if the NOT operator was not there, you would have 0 results. You should move the filter after the rex comand when its available. Like this
sourcetype="psoftapp-appsrv" host="csappprd*"
earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0
| rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?<userID[^,]*)"
| search NOT (userID=PSAPPSRV OR userID=GUEST )
| bucket _time span=1h
| top limit=2 userID by host, _time
Though the captured name in the rex command got truncated, I'm assuming it was UserID. So, the field didn't exist in the base search (where you added filter NOT (userID=PSAPPSRV OR userID=GUEST )
), hence the filter never took place. In fact if the NOT operator was not there, you would have 0 results. You should move the filter after the rex comand when its available. Like this
sourcetype="psoftapp-appsrv" host="csappprd*"
earliest=10/03/2016:09:00:0 latest=10/03/2016:11:00:0
| rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?<userID[^,]*)"
| search NOT (userID=PSAPPSRV OR userID=GUEST )
| bucket _time span=1h
| top limit=2 userID by host, _time
move the filter after the rex command!!! that works. Thank you verymuch