Hi,
I have following sample log string ,
May 13 14:20:32 pcpsd1sb.smart.net 318324: May 13 14:20:31.282 EDT: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet7/6 (not half duplex), with RDCBKL1LSW1 FastEthernet0/24 (half duplex).
In this i need to get
1. pcpsd1sb.smart.net
2. GigabitEthernet7/6 alone in different fields.
But in future there might be change in logs based on different settings.
Requirement :
I need to extract the words in these places and create two new fields .
Regards,
sundar
You need to find a starting pattern match and extract these fields. Here timestamp is match for field1 and text "discovered on" for field2 -
<base search> | rex "(\d{2}\:){2}\d{2}(?<field1>[^\s]+)"
| rex "discovered\s+on\s+(?<field2>[^\s]+)"
You need to find a starting pattern match and extract these fields. Here timestamp is match for field1 and text "discovered on" for field2 -
<base search> | rex "(\d{2}\:){2}\d{2}(?<field1>[^\s]+)"
| rex "discovered\s+on\s+(?<field2>[^\s]+)"
Thank you dineshraj9