This is what I have so far:
| eval output = if (Object = "false", [rex field=_raw"(?s)(?.*)(?), "Empty"
What I am trying to do is to perform a regex on a line if the value of the object is false. The reason I'm doing this is because I have an xml file that, when generated, the output can be 1 of 2 things. depending the Object value is the rex that needs to be used (I will be changing the "Empty" tag for another rex if this is possible).
The way I do it is with match.
| eval output = if(match(Object,"regex goes here"),"false", "empty")
Or something along those lines.
Does that make sense or help?
No you can't, but you can do something like this
... | rex field=_raw "your reg ex 1 to extract <field1>" | rex field=_raw "your reg ex 2 to extract <field2>"
| eval output=if(Object="false", field1, field2)
Thanks both yours and the answer below worked. Thanks for all the help. I've tried this one before but never thought I had to call the rex field command again.
The way I do it is with match.
| eval output = if(match(Object,"regex goes here"),"false", "empty")
Or something along those lines.
Does that make sense or help?
Thanks both yours and the answer above worked. Thanks for all the help.
No problem, glad I could help.
Evals can be a bit tricky, always a fun time working through those switches.