I have a field called STATUS that is displaying two values:
I need to create a regex that would extract both the values and create a single field called Status.
Is there a way to do it?
There is an option [c|C] that can be used to ignore case sensitive phrases but I am unable to extract the right regex.
I was able to find a fix for my search.
We can use:
| eval STATUS = lower(STATUS) | ..
to merge both the upper case and lower case word results
Having some sample events would help, but this should get you started. You can also go to www.regex101.com to test regex strings.
... | rex "STATUS=(?P<Status>\w+)" | ...