topic Re: Label User IDs based on name in #Random

Label User IDs based on name

Madmax — Tue, 07 Nov 2023 19:29:51 GMT

index=gbts-vconnection * onEvent DISCONNECTED (host=Host1)
| rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds

This lists all Devices that have disconnected. I'm trying to create a chart that lists only Macs, or Windows based on a key word like "mac" or "laptop" in the Device name. I tried using eval command but can't seem to get it working.

Re: Label User IDs based on name

richgalloway — Tue, 07 Nov 2023 20:21:05 GMT

What exactly did you try with the eval command? How did the results not meet expectations?

To properly assist with a regex-related question, we need to see some example (sanitized) data. Have you confirmed the regular expression works on regex101.com? The "\\w+" constructs look like they should be something else (probably "\w+").

Re: Label User IDs based on name

Madmax — Tue, 07 Nov 2023 21:04:19 GMT

Yes it absolutely has data. I already have a full dashboard with disconnect data based on (IONS) User IDs, and Device names. I am just stuck on this request to be able to filter the data by device type using keywords. I don't think the eval command accepts wildcards like *mac* which I need. Some Device names are for example "John-mac" others are "laptop-Mary", etc.

I can get data using the following:

| stats count by "User ID"

| sort -count

but when I try using eval below it gives me nothing. I can confirm that there is a Device named IPAD, Perhaps I should use another command but I'm fairly new at this. Thank you!

|eval DeviceType=case(Device=IPAD, "Macs", Device=Laptop, "Windows")
|stats count by Device, DeviceType

Re: Label User IDs based on name

richgalloway — Tue, 07 Nov 2023 21:41:33 GMT

Again, without seeing sample data it's very difficult to determine why the search is not matching the data.

Try using quotes in the eval command

|eval DeviceType=case(Device="IPAD", "Macs", Device="Laptop", "Windows")

or use the match function to match an embedded string

|eval DeviceType=case(match(Device, "IPAD"), "Macs", match(Device, "Laptop"), "Windows")

Re: Label User IDs based on name

Madmax — Tue, 14 Nov 2023 15:03:26 GMT

Thank you for your help. You got me on the right track. While searching using that command I found another way to get what I was looking for by using the search command which I could then use wildcards to filter out what I need or don't need.

This gave me all Windows devices:

|search Device=*DESKTOP* OR *laptop* OR *lenovo* OR *dell* OR *HP*| stats dc("IONS") as total_users

This listed all devices besides what I was looking for:

| search NOT Device IN (*LAPTOP*,*Desktop*,*lenovo*,*dell*,*HP*,*MAC*,*Ipad*,) | stats dc("IONS") as total_users