problem extracting empty values

Be_JAR — Wed, 10 Apr 2024 06:33:56 GMT

Hi all,

I am ingesting data and I have a problem :

event example:
field1 = /var/log/asas/log1.log
field2 = /var/log/as/as/log2.log
field3 = /var/log/as/as/log3.log

in the sourcetype (props.conf) I do it like this:
^.*field1 \=\s*(?<log1>.*?)\s*\n
^.*field2 \=\s*(?<log2>.*?)\s*\n
^.*field3 \=\s*(?<log3>.*?)\s*\n

The problem is when the value of some field appears empty. In that case capture the following line. like this:

source:
field1 = /var/log/as/as/log1.log
field2 =
field3 = /var/log/log/as/log3.log

result:
log2= field3 = /var/log/logs/log3.log

I'm sure there is a way to fix it and make the field appear empty, but I can't find it. Does anyone know how to do it?

JAR

Re: problem extracting empty values

ITWhisperer — Wed, 10 Apr 2024 08:11:11 GMT

Try something like this

(?m)^.*field1 \=\s*(?<log1>\S*?)\s*\n (?m)^.*field2 \=\s*(?<log2>\S*?)\s*\n (?m)^.*field3 \=\s*(?<log3>\S*?)\s*\n

topic Re: problem extracting empty values in Knowledge Management

problem extracting empty values

Re: problem extracting empty values