I am using the following command to search :
index="real" | rex field="Location" (?
can anyone tell me how do i search multiple value like : here m searching for "mumbai" but if I would also like to search for "delhi" and "kol" then what i have to write ...
Please help me !!
Thanks
Abhay
wouldn't it be easier to do ?
index="real" Location="*mumbai*"
index="real" Location="*delhi*"
index="real" Location="*kol*"
OR if you dont have many values
index="real" | rex field="Location" (?<target>(mumbai|delhi|kol)) | search target=mumbai
but my output should come like this :
Name,age,company,target
xyz,45,kolkata,kolkata
xyz,45,kolkata is a mumbai,kolkata mumbai
xyz,45,ludhiaya
xyz,45,delhi, delhi
xyz,45,bangalore
"target" will be added as a last column and the matched keywords will be the value
Please help