I need to perform a search that extracts user ids from unformatted log lines where the user id would be extracted by one of the following rex commands.
Conceptually it would be something like:
sourcetype="LogsPRD" 22CD91CF-C32F-43E0-A8A6-A09F00D0B9F4
| rex field=_raw "Users\\\(?<xxx>\w*)"
OR rex field=_raw ": FEDERATED\\\(?<xxx>\w*)"
OR rex field=_raw "user FEDERATED\\\(?<xxx>\w*)"
| eval xxx=upper(xxx) | stats values(xxx)
So, it is essentially three searches with the results to be combined. Does this make any sense?
The best thing to do would probably be to use props and transforms. If you define each of these rex commands as a REPORT transform you can then specify multiple in your props.conf and the first successful extraction will be used. See that here:
In the shortterm you can make the regex more complicated to use it in one.
argh link isn't taking you to the section of the page, just scroll there, it's the first example, Configuring a field extraction that utilizes multiple field transforms