I am looking to enhance a search with a lookup (if it returns an IP) to replace the value returned in the TID field if it matches an IP instead of a DNS name. I am experimenting with the following but not sure how to do the lookup correctly if the if statement returns a "yes" (or if using eval is even the best method) | eval TID=if(cidrmatch("10.0.0.0/8", ), , TID) Ex: TID: myhostname.acmerocket.com (Do nothing) TID: 10.100.0.1 (Replace with hostname from myacmelookup.csv) Examples of possible fields in myacmelookup.csv IP: 10.100.0.1 HOST: coyote.acmerocket.com IP: 10.100.0.2 HOST: myhostname.acmerocket.com ... View more

I am using regex slot and port information. Here is an example of the syslog output: Slot1 : OLTPort2 Is it possible in regex to remove the spaces around the :? I would like it to look like this: Slot1:OLTPort2 By using two captures I can use eval to combine two extracts but I would prefer to do it with regex, if possible. | where isnotnull(S_Slot) AND isnotnull(S_Port) | eval SlotAndPort = S_Slot . ":" . S_Port ... View more

I am trying to integrate a lookup into a search with no success. My goal is to run the search, lookup the hostname or TID and compare it to the lookup table (HOSTNAME field) and return results based on matches to the ROLE field. The ROLE column in the lookup that defines whether TID is core, cpe or aggregation. Here is my search: index=my_main "SFP receive power low alarm set" | stats dc(date_mday) as Days, count by TID, J_Port | eval c_TID=upper(c_TID) | where Days > 2 AND count > 49 | appendpipe [stats count | where count=0] | rename count as "Total Errors", TID as Hostname, J_Port as Port | sort -"Total Errors" The lookup table file and definition are working. My difficulty is integrating it into my search. ... View more

I am new to Regex and hopefully someone can help me. I am trying to extract data between "[" and "SFP". It doesn't matter what the data is or length of the extract as it varies. example 1: Jul 1 13:10:07 -07:00 HOSTNAME [MIC(0/2) link 0 SFP laser bias current high warning set ] example 2: Jul 10 16:08:20 -04:00 HOSTNAME [sfp-1/0/2 link 2 SFP laser bias current high warning set ] Thanks! ... View more