Log:
Aug 28 17:46:20 192.168.111.14 08/28/2019:16:46:18 GMT 0-PPE-0 : default TCP OTHERCONN_DELINK 1091143 0 : Source 192.168.2.166:19301 - Vserver 192.168.2.165:22 - NatIP 192.168.2.166:19301 - Destination 192.168.2.165:22 - Delink Time 08/28/2019:16:46:18 GMT **Total_bytes_send** 2333 - Total_bytes_recv **3173**
Use this
|rex "Total_bytes_send (?<total_bytes_send>\d+)"
|rex "Total_bytes_recv (?<total_bytes_recv>\d+)"
Hi diogofgm,
you can use only one regex:
Total_bytes_send\*\*\s+(?<Total_bytes_send>\d+)\s+-\s+Total_bytes_recv\s+\*\*(?<Total_bytes_recv>\d+)
as you can test at https://regex101.com/r/3A8TRw/1
Bye.
Giuseppe
I know. But since the OP only posted one event and not I don't know all the variations of events containing these fields, using separate regexes is less risky since it will work on any event regardless the field order or position and its not really impacting performance doing with separate regexes.
Use this
|rex "Total_bytes_send (?<total_bytes_send>\d+)"
|rex "Total_bytes_recv (?<total_bytes_recv>\d+)"
Total_bytes_send 2333 - Total_bytes_recv 3173
Quoted is the value of total_bytes_send and total_bytes_recv
thanks it works.
hi @sarbankumar please try @diogofgm 's answer...it works 🙂 Please accept the answer if it works for you