Hello, I need help extracting the following value from this sample event:
2015-10-12 09:15:01,590 CDC_HB_RCV C M DT 2015-10-12 13:00:01.980943 2015-10-12 13:00:05.653721 000:00:03.672778 Y
2015-10-12 09:15:01,482 CDC_HB_SEND M <none> RF 2015-10-12 13:15:01.480964
Event types are CDC_HB_RCV and CDC_HB_SEND.
The bolded M in the first event is Destination_Code, required in the CDC_HB_RCV event type. The "C" to the left of it is Source_Code.
However, in the CDC_HB_SEND type, it is blank (no value, since there is no destination code). The Source_Code for that event is M, on the left.
There are multiple CDC_HB_SEND and CDC_HB_RCV events, and they are all under one sourcetype=cdc_heartbeat_log.
I have had trouble extracting since CDC_HB_RCV contains the Destination_Code field, and CDC_HB_SEND does not, however they are all under the same sourcetype.
I have managed to extract all the other relevant fields in the data, except for Destination_Code.
Any assistance is appreciated. Thanks!
... View more