Hi,
I have the below base search,
index="appv" (sourcetype="AppV-User" *PUT /package*) OR (sourcetype=sql_appv_packageversion) | rex "\/packages\/\w+\/(?<Id>\w+)\s+-\s+\d+\s+(?<User>[^ ]+)" | stats dc(sourcetype) AS dc_sourcetype values(Name) AS Name values(User) AS User BY Id | where dc_sourcetype=2
Statistics of this search is as below,
Id dc_sourcetype Name User
323 2 Putty v0.72 User A
I have extracted a field called 'Enabled' which has values of either Enabled=0 or Enabled=1
How do i update my search query so the table is shown as below
Id dc_sourcetype Name User Enabled
323 2 Putty v0.72 User A 0 or 1
thanks for the response. I tried this query but Enabled is not giving any value
Id dc_sourcetype Name User Enabled
323 2 Putty v0.72 User A
@SS1 Does `Enabled` field is getting extracted already? if not then add `Enabled` field extraction logic before stats command.
@SS1 you may want to use values(<fieldname>) as <newfieldname> like below-
index="appv" (sourcetype="AppV-User" *PUT /package*) OR (sourcetype=sql_appv_packageversion) | rex "\/packages\/\w+\/(?<Id>\w+)\s+-\s+\d+\s+(?<User>[^ ]+)" | stats dc(sourcetype) AS dc_sourcetype values(Name) AS Name values(User) AS User values(Enabled) as Enabled BY Id | where dc_sourcetype=2