Reg Ex/ REX to match patterns

[rczone]

Hello All,

THis might be simple question but need some guidance here:

i'm using pattern match like below but not satisfied with using double match conditions

match(ALERT_DESCRIPTION,"(FILE_test_file)") AND match(ALERT_DESCRIPTION,"For transaction Login \. 3 out of 3 transactions failed") ), "Global FIle Issue" 

Here ALERT_DESCRIPTION is a column in a table and Global FIle Issue is where the alert has to be named if the condition satisfied.

The description has the actual description of the error ..but im filtering the errors based on the issue so using match function here ..i want to use rex function inside match(or esle pls guide me how to check 2 strings patterns in single match function instead of multiple match functions

like this

match(ALERT_DESCRIPTION,"(rex <<magic goes here>)",  "Global FIle Issue" 

[vnravikumar]

Hi

Try this

| makeresults 
| eval ALERT_DESCRIPTION ="test For transaction Login . 3 out of 3 transactions failed 1234" 
| append 
    [| makeresults 
    | eval ALERT_DESCRIPTION ="test FILE_test_file test" ] 
| append 
    [| makeresults 
    | eval ALERT_DESCRIPTION ="test" ] 
| eval ISSUE_TYPE=case((match(ALERT_DESCRIPTION,"(FILE_test_file) | (For transaction Login \\. 3 out of 3 transactions failed)")),"Global FIle Issue",true(),"-")

[mayurr98]

try like

case(like(ALERT_DESCRIPTION,"%(FILE_test_file)%") AND like(ALERT_DESCRIPTION,"%For transaction Login \. 3 out of 3 transactions failed%"), "Global FIle Issue")

[rczone]

@mayurr98 Thankyou for the response...my idea is to shorten the query (cutdown the usage of multiple AND)

im getting what i want with multiple match functions

IS there anyway can i use those strings in a single 'like' or 'match' function?

like below:
case( match(ALERT_DESCRIPTION,"(FILE_test_file)") | ("For transaction Login . 3 out of 3 transactions failed%, ), "Global FIle Issue"

[mayurr98]

can I see your entire search query?

[rczone]

index="m_data" sourcetype="uat:tables"
| fillnull value="Unknown"
| search SIG_TEAM_NAME IN ("" , "TESTAPP") ALERT_DESCRIPTION IN ("") ALERT_ID IN ("*") ALERT_SUPPORTGROUP IN ("TESTAPP")
| dedup ALERT_ID
| rex "KB_List\":\"(?[^\"]+)"
| table SIG_ID ALERT_ID SIG_ENVIRONMENT ALERT_HOSTNAME ALERT_INSTANCE KB_List ISSUE_TYPE ALERT_DESCRIPTION SIG_DESCRIPTION ALERT_STATUS ALERT_SUPPORTGROUP ALERT_FIRST_EVENT_TIME ALERT_LAST_EVENT_TIME
| sort ALERT_ID
|eval ISSUE_TYPE=case( match(ALERT_DESCRIPTION,"(FILE_test_file)") | ("For transaction Login . 3 out of 3 transactions failed%, ), "Global FIle Issue"

[rczone]

| eval ISSUE_TYPE=case( match(ALERT_DESCRIPTION,"(FILE_test_file)") | ("For transaction Login . 3 out of 3 transactions failed%, ), "Global FIle Issue"
@mayurr98