topic Re: Extracting everything but numbers from _raw message in props.conf in Getting Data In

Extracting everything but numbers from _raw message in props.conf

cpeteman — Wed, 21 Aug 2013 20:46:26 GMT

I want to extract all characters but digits and have that as a new field. I've done this with easy in search:

|rex mode=sed "/s\d+//g" | rename _raw AS new_field

but this will not let me see the original _raw message nor does props.conf seem to be able to use one field in a new extraction so I cant extract (copy) _raw and the get rid of numbers using SEDCMD. How do I do this? help please???

Re: Extracting everything but numbers from _raw message in props.conf

kristian_kolb — Wed, 21 Aug 2013 21:09:18 GMT

could this be a good thing?

your_base_search | eval new_field = _raw | rex field=new_field mode=sed "s/\d+//g" | stats c by new_field

Re: Extracting everything but numbers from _raw message in props.conf

cpeteman — Wed, 21 Aug 2013 21:17:59 GMT

I would prefer to be able to do it as a default field whereas if I went this way it'd probably end up as a macro, but it's given me some ideas. I'll get back to you. Thanks.

Re: Extracting everything but numbers from _raw message in props.conf

cpeteman — Thu, 22 Aug 2013 18:26:00 GMT

Well this helped me find a solution even though it ended up being a macro.