hi, my search is:
sourcetype:sys src_ip_groupname=list1 OR src_ip_groupname=list2 | table src_ip dest_ip src_ip_groupname
The problem is that src_ip_groupname has eg: IANA Reserved, CountryX,list1.
so my | table src_ip dest_ip src_ip_groupname is:
IP-1 IP-2 IANA Reserved,CountryX,list1
IP-3 IP-4 CountryY,list2
What i want is to | table src_ip dest_ip Assigned Country List
IP-1 IP-2 IANA Reserved CountryX list1
IP-3 IP-4 - CountryY list2
Thank you for help
Try extraction these fields with optional condition this way -
sourcetype:sys src_ip_groupname=list1 OR src_ip_groupname=list2 | rex field=src_ip_groupname "((?<Assigned>[^\,]+)\,)?(?<Country>[^\,]+)\,(?<List>[^\,]+)" | fillnull value="-" Assigned | table src_ip dest_ip Assigned Country List
Try extraction these fields with optional condition this way -
sourcetype:sys src_ip_groupname=list1 OR src_ip_groupname=list2 | rex field=src_ip_groupname "((?<Assigned>[^\,]+)\,)?(?<Country>[^\,]+)\,(?<List>[^\,]+)" | fillnull value="-" Assigned | table src_ip dest_ip Assigned Country List
absolutely majestic dineshraj thank you very much