Good Day!
Insight would be much appreciated on the following...
The data below may or may not have the occurrence of the string 'tstp'. If 'tstp' doesn't occur, I'd like to populate the tstp_date and tst_time variables in the search below with the value 'foo'. Is it possible, in the context of a regular expression to assign 'foo' to my variables tstp_date and tstp_time if the string 'tstp' does not occur in the data?
My data looks like....
lease 1.2.3.4 {
starts 2 2014/11/11 05:47:49;
ends 2 2014/11/11 09:47:49;
tstp 2 2014/11/11 09:47:49;
cltt 2 2014/11/11 05:47:49;
binding state free;
hardware ethernet 60:33:4b:ce:83:1b;
uid "\001`3K\316\203\033";
}
lease 4.3.2.1 {
starts 2 2014/11/11 11:42:12;
ends 2 2014/11/11 15:42:12;
cltt 2 2014/11/11 11:42:12;
binding state active;
next binding state free;
hardware ethernet a4:c3:61:77:30:80;
uid "\001\244\303aw0\200";
}
My search...
...| rex "^.*?lease\s+(?<lease_ip>[\d\.]+) {\s+starts \d (?<start_date>\S+) (?<start_time>\S+?);\s+ends \d (?<ends_date>\S+) (?<ends_time>\S+?);\s+(?(?=tstp)tstp \d (?P<tstp_date>\S+) (?P<tstp_time>\S+)|)" | eval tstp_date=if(isnull(tstp_date),"foo",tstp_date)
My logic was to lookahead for the occurrence of 'tstp', if that exists, then capture tstp_date (e.g. 2014/11/11) and tstp_time (e.g. 09:47:49). If you note above, I added the eval to take care of null valued 'tstp_date' and 'tstp_time', but this is done outside the regex.
Thanks!
... View more