Create new fields based on value of another fields.

paragvidhi — Fri, 08 May 2020 15:17:47 GMT

Hi All,
In my log, I have one field called ServerName. Below are some values of that field.

DAAPP2aBANG2
DFAPP20bLON2
UATSER1aUS1
UATSER1bUS2

We differentiate the above server with node A and node B based on the first character we got after the first occurrence of one or more digit.

DAAPP2aBANG2 -- its node a
DFAPP20bLON2 --- its node b
UATSER1aUS1 --- its node a
UATSER1bUS2 --- its node b

Here I want to create two fields called NodeA, and NodeB

In NodeA it should contain DAAPP2aBANG2 ,UATSER1aUS1
In NodeB it should contain DFAPP20bLON2, UATSER1bUS2

Re: Create new fields based on value of another fields.

gcusello — Fri, 08 May 2020 15:32:31 GMT

Hi @paragvidhi,
you could try something like this:

index=your_index
| rex field=ServerName "\w+\d(?<Node>a|b)"
| eval Node="Node ".Node
| table ServerName Node

Ciao.
Giuseppe