How do you parse the below events?
The events looks like :
2018-12-04 01:51:08.330, LogDate="2018-12-04 01:51:08.33", SessionId="abc", MachineName="xyz", LoggerName="def", LogLevel="DEBUG", MessageId="DumpCacheNames", Message="def", ApplicationId="fgd", EndpointStack="abc", LogInsertDate="date"
I need to show events as:
"2018-12-04 01:51:08.330"
SessionId=abc
MachineName=xyz
LoggerName=def
LogLevel=DEBUG
MessageId=DumpCacheNames
Message=def
ApplicationId=fgd
EndpointStack=abc
LogInsertDate=date
Thanks !
You want to change the appearance of the raw events, or you want to extract the fields? Based on your example, I'm assuming the first.
Not entirely sure why you'd want to format the raw events, but something like this should work:
in props.conf
[yoursourcetype]
SEDCMD-0split_to_lines = s/,\s/\n/g
SEDCMD-1strip_quotes = s/"//g
SEDCMD-2add_quotes = s/^([^\r\n]+)/"\1"/
Example in the searchbar:
| makeresults
| eval _raw = "2018-12-04 01:51:08.330, LogDate=\"2018-12-04 01:51:08.33\", SessionId=\"abc\", MachineName=\"xyz\", LoggerName=\"def\", LogLevel=\"DEBUG\", MessageId=\"DumpCacheNames\", Message=\"def\", ApplicationId=\"fgd\", EndpointStack=\"abc\", LogInsertDate=\"date\""
| rex mode=sed "s/, /\n/g"
| rex mode=sed "s/\"//g"
| rex mode=sed "s/^([^\r\n]+)/\"\1\"/"
You want to change the appearance of the raw events, or you want to extract the fields? Based on your example, I'm assuming the first.
Not entirely sure why you'd want to format the raw events, but something like this should work:
in props.conf
[yoursourcetype]
SEDCMD-0split_to_lines = s/,\s/\n/g
SEDCMD-1strip_quotes = s/"//g
SEDCMD-2add_quotes = s/^([^\r\n]+)/"\1"/
Example in the searchbar:
| makeresults
| eval _raw = "2018-12-04 01:51:08.330, LogDate=\"2018-12-04 01:51:08.33\", SessionId=\"abc\", MachineName=\"xyz\", LoggerName=\"def\", LogLevel=\"DEBUG\", MessageId=\"DumpCacheNames\", Message=\"def\", ApplicationId=\"fgd\", EndpointStack=\"abc\", LogInsertDate=\"date\""
| rex mode=sed "s/, /\n/g"
| rex mode=sed "s/\"//g"
| rex mode=sed "s/^([^\r\n]+)/\"\1\"/"
@FrankVl
Great Buddy. It worked. Thanks 🙂
I want to change the appearance, it is already available in DB connect v1.
Try
...|kv
or in props.conf-
KV_MODE = auto
Nup didn't work. Any other suggestion?
i tried with sample data and it is working as expected
| makeresults |eval _raw="\"2018-12-04 01:51:08.330\"
SessionId=abc
MachineName=xyz
LoggerName=def
LogLevel=DEBUG
MessageId=DumpCacheNames
Message=def
ApplicationId=fgd
EndpointStack=abc
LogInsertDate=date"| kv
Try with this string
2018-12-04 01:51:08.330, LogDate="2018-12-04 01:51:08.33", SessionId="abc", MachineName="xyz", LoggerName="def", LogLevel="DEBUG", MessageId="DumpCacheNames", Message="def", ApplicationId="fgd", EndpointStack="abc", LogInsertDate="date"