Hi guys,
Our search query is like this
LogName=Application SourceName=Script | rex "Days Remaining: (?.*)days" | rex ": Origin=(?.+?)\," | rex (?.+?)\; | table CertificateName, DaysRemaining
Output will provide us a table with 2 columns as “CertificateName” and “DaysRemaining” in which “CertificateName” will have the names of the Certificates and “DaysRemaining” will have the days left for certificate expiry.
But sometimes, the “DaysRemaining” column will have not any numbers for few of the “CertificateNames” and remains blank as attached here in the screen shot.
Is there any way...
Please advise.
Hi @roopeshetty
Try like
LogName=Application SourceName=Script | rex "Days Remaining: (?.)days" | rex ": Origin=(?.+?)\," | rex (?.+?)\; |search DaysRemaining=* | table CertificateName, DaysRemaining
This will remove null row of DaysRemaining
you can try | fillnull value="Not Available" DaysRemaining