I am performing a search where I want to find events if one of two fields matches a specific pattern (which is the same for both fields). I've tried regex, but it doesn't seem to like an OR operator.
search traffic | transaction Acct_ID startswith="START" endswith="STOP" | regex Egress="^\w{3}\d{4}" OR regex Ingress="^\w{3}\d{4}"
Is there any way to do this?
I believe you are close, however since regex drops events, I'd go a different path and use some matching in eval. Try this:
search traffic | transaction Acct_ID startswith="START" endswith="STOP"| eval ematch=if(match(Egress,"^\w{3}\d{4}"),1,0)|eval imatch=if(match(Ingress,"^\w{3}\d{4}"),1,0)|where ematch>0 OR imatch>0
I believe you are close, however since regex drops events, I'd go a different path and use some matching in eval. Try this:
search traffic | transaction Acct_ID startswith="START" endswith="STOP"| eval ematch=if(match(Egress,"^\w{3}\d{4}"),1,0)|eval imatch=if(match(Ingress,"^\w{3}\d{4}"),1,0)|where ematch>0 OR imatch>0
Thanks! Just doing my part to help!
+1 @alacercogitatus Really nice way of avoiding using the regex command and using the eval functions instead. My solutions would have been to use rex to grab things out.
You are a rock star! Works great. Thanks!