Need to trim search result from left till occurange of PulseSecure: and get everything after that. Note post PulseSecure: line length and character may vary. Charcter is mix or alfabet, number, special characters etc
Sample:-
Dec 27 06:29:37 AAAAAA PulseSecure: 2021-12-27 06:29:37 - AAAAAA - [110.1.1.1] Default Network::aa.aa.aa(AAA_BBB)[BB_CC_EEE]
I need result as below to be saved in field Extracted
2021-12-27 06:29:37 - AAAAAA - [110.1.1.1] Default Network::aa.aa.aa(AAA_BBB)[BB_CC_EEE]
| rex "PulseSecure: (?<Extracted>.*)"
i have to extract from field _raw the string portion after PulseSecure: till end of the log
i have to extract from field _raw the string portion after PulseSecure: till end of the log
Pls run this and update us what result you get:
yourbasesearch | rex field=_raw "PulseSecure: (?<Extracted>.*)" | table Extracted
still not working, the extracted field is empty
Hi @aliasgar215 ..
this is a basic rex and there is no way that this can go wrong. so you are doing some simple mistakes, you should reply some sample messages and your complete search query, then only this can be troubleshooted. hope you understand, thanks.
Extracted column came empty not working
Here is an example in regex101.com showing it working - the test string is the string you provided - if this does not match your actual events, please provide more examples
my data is un _raw field, so to copy my data with your filter to extracted field, is any thing missing in below syntax.
| rex "PulseSecure (?<Extracted>.*)"
Hi @aliasgar215,
You have missing : after PulseSecure, could you please try below? Maybe there are nonprintable characters after :
| rex "PulseSecure:\s+(?<Extracted>.*)"
still same, not working
Please can you share more events in a code block </> so we can try to see what might be different
| rex field=un_raw "PulseSecure: (?<Extracted>.*)"