Hello
In a report, i used the code below in order to search for an error code in my events.
But, when a code is found, i want to display the complete line event and not only the code error.
index=main sourcetype="applog" | rex "Failed Error code : (?<ErrorCode>.*)" |table host ErrorCode
Thanks in advance for your help.
Depending on what exactly you're trying to do, there's a few ways to do it.
index=main sourcetype="applog" "Failed Error code : "
index=main sourcetype="applog" | regex "Failed Error code :"
index=main sourcetype="applog" | rex "Failed Error code : (?<ErrorCode>.*)" | table host ErrorCode _raw
@jip31
Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!
Depending on what exactly you're trying to do, there's a few ways to do it.
index=main sourcetype="applog" "Failed Error code : "
index=main sourcetype="applog" | regex "Failed Error code :"
index=main sourcetype="applog" | rex "Failed Error code : (?<ErrorCode>.*)" | table host ErrorCode _raw