For below input I tried search query as
index=myindex "Notification"|rex "(MQ) (?\d+) = (?\w+)"|stats count(Notification)
However, its not working says "no result found". The moment I take off ==> stats count(Notification)
it shows values
Input:
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = EMAIL
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = SMS
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = VOICE
Output
Notification Type TypeCode
MQ EMAIL
MQ SMS
MQ VOICE
Okay, reading what I can read, i don't see why it would succeed.
Your rex
is looking for a decimal number after (MQ) and before the =, which is not in your data.
Something like this should pull the two fields...
| rex "Notification Type \((?<NotifType>[^\)]*)\) = (?<TypeCode>\w+)"
Okay, reading what I can read, i don't see why it would succeed.
Your rex
is looking for a decimal number after (MQ) and before the =, which is not in your data.
Something like this should pull the two fields...
| rex "Notification Type \((?<NotifType>[^\)]*)\) = (?<TypeCode>\w+)"
Thank you Jean. I figured out my mistake with your help 🙂
You query is truncated. Please edit the question to add the query again and ensure that you select the query and click on button "101010" OR press Ctrl+K to format the code (to retains all formatting/content). Do the same for your raw data and output