index=gbts-vconnection * onEvent DISCONNECTED (host=Host1)
| rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds
This lists all Devices that have disconnected. I'm trying to create a chart that lists only Macs, or Windows based on a key word like "mac" or "laptop" in the Device name. I tried using eval command but can't seem to get it working.
Thank you for your help. You got me on the right track. While searching using that command I found another way to get what I was looking for by using the search command which I could then use wildcards to filter out what I need or don't need.
This gave me all Windows devices:
|search Device=*DESKTOP* OR *laptop* OR *lenovo* OR *dell* OR *HP*| stats dc("IONS") as total_users
This listed all devices besides what I was looking for:
| search NOT Device IN (*LAPTOP*,*Desktop*,*lenovo*,*dell*,*HP*,*MAC*,*Ipad*,)
| stats dc("IONS") as total_users
What exactly did you try with the eval command? How did the results not meet expectations?
To properly assist with a regex-related question, we need to see some example (sanitized) data. Have you confirmed the regular expression works on regex101.com? The "\\w+" constructs look like they should be something else (probably "\w+").
Yes it absolutely has data. I already have a full dashboard with disconnect data based on (IONS) User IDs, and Device names. I am just stuck on this request to be able to filter the data by device type using keywords. I don't think the eval command accepts wildcards like *mac* which I need. Some Device names are for example "John-mac" others are "laptop-Mary", etc.
I can get data using the following:
| stats count by "User ID"
| sort -count
but when I try using eval below it gives me nothing. I can confirm that there is a Device named IPAD, Perhaps I should use another command but I'm fairly new at this. Thank you!
|eval DeviceType=case(Device=IPAD, "Macs", Device=Laptop, "Windows")
|stats count by Device, DeviceType
Again, without seeing sample data it's very difficult to determine why the search is not matching the data.
Try using quotes in the eval command
|eval DeviceType=case(Device="IPAD", "Macs", Device="Laptop", "Windows")
or use the match function to match an embedded string
|eval DeviceType=case(match(Device, "IPAD"), "Macs", match(Device, "Laptop"), "Windows")
Thank you for your help. You got me on the right track. While searching using that command I found another way to get what I was looking for by using the search command which I could then use wildcards to filter out what I need or don't need.
This gave me all Windows devices:
|search Device=*DESKTOP* OR *laptop* OR *lenovo* OR *dell* OR *HP*| stats dc("IONS") as total_users
This listed all devices besides what I was looking for:
| search NOT Device IN (*LAPTOP*,*Desktop*,*lenovo*,*dell*,*HP*,*MAC*,*Ipad*,)
| stats dc("IONS") as total_users