My iis data has a field name cs_uri_query
, for example:
Cmd=Sync&User=XYZ%5Cjqpublic%40xyz.com&DeviceId=SEC539D6F312D5B3&DeviceType=SMG930V
Thusernameme is embedded in this field and I use the following regex to extract a new field called user_name:
^[^%]*%\d\w(?P\w+)
The new field is extracted properly and shows as:
user_name = jqpublic
However, if I do a specific search like:
index=iis host=server1 user_name=jqpublic
I get no results.
Only if I trim the field, or use a wildcard, are results returned:
index=iis | eval user_name=trim(user_name) | search user_name=jqpublic
Any thoughts why trim is required here?
Thanks!
Yes that works, as does creating a calculated field that trims the extracted field. But what I want to know is why any of this is necessary. Why doesn't the original extraction work correctly?
Thanks!
not sure which regex expression you are using...
It seems your extracted user_name
field contains spaces so you need to trim...
Hey have you tried this:
index=iis|rex "^[^%]*%\d\w(?P<user_name>\w+)"|search user_name="jqpublic"