Hey everyone, I am trying to put the following into a dashboard:
index=corrtest sourcetype=as-cdr AS_Service_Provider=wdv-trunking AS_AS_Call_Type!=Interim (AS_Calling_Number=*$TN$ OR AS_Called_Number=*$TN$)
|where isnotnull(AS_Access_Call_ID) AND isnotnull(AS_Network_Call_ID)
|rex field=AS_Local_Call_ID "(?P<AS_Local_Call_ID_Trimmed>\d+)(?=:)"
|dedup AS_Local_Call_ID_Trimmed
|eval MSP_vqmcallid=AS_Access_Call_ID
|join type=left MSP_vqmcallid [search index=corrtest sourcetype=msp]
|table _time AS_AS_Call_Type AS_Access_Call_ID AS_Answer_Indicator AS_Answer_Time AS_Call_Category AS_Called_Number AS_Calling_Number AS_Charge_Indicator AS_Charge_Indicator_Description AS_Codec AS_Codec_Usage AS_Dialed_Digits AS_Direction AS_Group_Number AS_Local_Call_ID AS_Network_Call_ID AS_Network_Call_Type AS_Network_Translated_Number AS_Original_Called_Number AS_Original_Called_Reason AS_Redirecting_Number AS_Redirecting_Reason AS_Release_Time AS_Releasing_Party AS_Remote_Call_ID AS_Route AS_Service_Provider AS_Start_Time AS_Termination_Cause AS_Termination_Cause_Description AS_Transfer_Invocation_Time AS_Transfer_Type AS_Trunk_Group_Info AS_Trunk_Group_Name AS_Type AS_User_Time_Zone MSP_created MSP_serialnumber MSP_avgjbenvdelay MSP_vqmcallid MSP_vqmcallstart MSP_vqmdegradationdiscart MSP_vqmdegradationecholevel MSP_vqmdegradationloss MSP_vqmdegradationnoiselevel MSP_vqmdegradationrecency MSP_vqmdegradationsignallevel MSP_vqmdegradationvocoder MSP_vqmmoslq
|sort -_time95
When trying to save, I get an error that there is a problem with the XML. I know the issue exists in this line:
|rex field=AS_Local_Call_ID "(?P<AS_Local_Call_ID_Trimmed>\d+)(?=:)"
Is there any other way to use a capture group? Or can I do this some other way???
