How do you write props and transforms for my below search?

[raghuchams4527]

I'm looking for transforms and props.conf to get the two fields act and action

index=blue_sec sourcetype=rsa:security_analytics
|rex field=_raw "act=(?[^\"]+)\sspt="| makemv delim="," act| stats values(act) AS action by _raw  
|rex field=_raw "act=(?[^\"]+)\sspt=" | table act,action

[gcusello]

HI raghuchams4527,
did you tried to extract your fields using the Field Extractor?
You can use your regexes.

Otherwise, you can go in fields section and create a new field using your regexes.

To better help you, could you use the Code Sample button to display your regexes? without it it isn't possible to correctly see your regex.

Bye.
Giuseppe

[raghuchams4527]

Thanks for the suggestion. I'm looking for the transforms how to write makemv delim and stats command in props and transform.

[gcusello]

HI raghuchams4527,
if you want, you can create a macro with your commands, this is useful if you think to reuse your search.
Bye.
Giuseppe

[raghuchams4527]

how to create a macro?

[gcusello]

HI raghuchams4527,
go in Settings -- Advanced Search -- Search macros -- Add new
and then copy your commands or part of them.
Bye.
Giuseppe

[gcusello]

HI raghuchams4527,
if you're satisfied by this answer, please accept and/ot upvote it.
Bye.
Giuseppe

[raghuchams4527]

thanks cusello

[skoelpin]

What are you trying to do? I see you're using rex to extract fields but they don't have names. Also, whats your purpose for wanting to use transforms and props?

[raghuchams4527]

index=blue_sec sourcetype=rsa:security_analytics
|rex field=_raw "act=(?[^\"]+)\sspt="| makemv delim="," act| stats values(act) AS action by _raw

|rex field=_raw "act=(?[^\"]+)\sspt=" | table act,action

[raghuchams4527]

Actually i put the name for rex but its not displayed on the result. (?)

[raghuchams4527]

I want to extract act and action fields. If you remove the stats command im not getting the unique values from action field.

the values i'm looking
act = GET,POST,GET,GET,GET,GET,POST,POST
action = GET POST

[raghuchams4527]

I want to extract act and action fields. If you remove the stats command im not getting the unique values from action field.

the values i'm looking
act = GET,POST,GET,GET,GET,GET,POST,POST
action = GET POST