Need to compile a regex for a field

[mmohiuddin]

I have a field called STATUS that is displaying two values:

STATUS=In

STATUS=IN

I need to create a regex that would extract both the values and create a single field called Status.

Is there a way to do it?

There is an option [c|C] that can be used to ignore case sensitive phrases but I am unable to extract the right regex.

[mmohiuddin]

I was able to find a fix for my search.

We can use:

| eval STATUS = lower(STATUS) | ..

to merge both the upper case and lower case word results

[richgalloway]

Having some sample events would help, but this should get you started. You can also go to www.regex101.com to test regex strings.

... | rex "STATUS=(?P<Status>\w+)" | ...