Hello Splunkers
I have a query that returns two possible values
11/06/19 16:50:59.54-06:00 [104348] Special Finance: Customer Accepted Terms
11/05/19 17:03:36.71-05:00 [506779] Special Finance: Customer Qualified
What I want to do is capture "Customer Accepted" and "Customer Qualified" as two separate fields so I can present them with some metrics.
Ultimately I want to have a report like this
Host Customer Qualified Customer Accepted adoption rate
Location 1 10 5 50%
thanks in advance
try this:
index=<your_index>| rex "(?<field1>Customer Accepted)"| rex "(?<field2>Customer Qualified)"
great info thanks
try this:
index=<your_index>| rex "(?<field1>Customer Accepted)"| rex "(?<field2>Customer Qualified)"