Help me with Rex
"SSOUSERDATA":"INDV=12345678|ONE|testd44|ABCD,ABCD_ABCDABCD"
"X-comGlobalSessionID":"Abcdef2OtOEWYEX0TA6B1KQ"
"X-comPrimaryIdentity":"12345678"
"X-comImpersonatedIdentity":"12345678"
"msgContentType":"Exception due to so and so"
...|extract kvdelim=":" pairdelim=" "
If that works in search, it can be done automatically in props.conf too
This would be the obvious choice, but OP said he wanted rex
How about this?
... | rex \":\"(?<skoelpin>.+)(?=\")
Your fieldname will be skoelpin
🙂
i want to retrive "INDV=12345678|ONE|testd44|ABCD,ABCD_ABCDABCD"
from the event. can you help me with rex.
"SSOUSERDATA":"INDV=12345678|ONE|testd44|ABCD,ABCD_ABCDABCD"
This will capture the value "INDV=12345678|ONE|testd44|ABCD,ABCD_ABCDABCD"
... | rex \":\"(?<skoelpin>.+)(?=\")