I want to generate a report by using a log file as an input. The log file is like:
01/16/2018 process 1 successful
01/16/2018 process 2 successful
01/16/2018 process 3 successful
I want "process 2 successful" as a field so that I can use the transforming command to generate a report.
Please use _raw instead of x
you can use rex command to extract the desired text
rex field=x "^\S+ (?<text>\w+\s+\d+\s+\w+)"
See the example below-
| makeresults
| eval x="2018/12/09 process 1 successful"
| appendpipe
[| eval x="2018/12/09 process 2 successful"
| appendpipe
[| eval x="2018/12/09 process 3 successful"]]
| rex field=x "^\S+ (?<text>\w+\s+\d+\s+\w+)"
Thanks for answer.
I tried following your example rex field=x "^\S+ (?\w+\s+\d+\s+\w+)" but still i am not able to extract the fields.