I have a field value named 'category' the raw values are for example.
"Audit Global - ABC - Login and Logout Audit"
"Audit Global - ABC - Login - SQL Exception"
When searching, the values for category are returned as only 'Audit' or the first 5 characters of the raw value. The field extraction is not working correctly for this field.
Any ideas on what to look at?
Thank you
This can be done pretty easily if you know when the value ends, i.e. if you know these values are enclosed in some special characters (like category="audit global ... exception") or if you know how the next field name is (like category=audit global ... exception next_field=). For the first case, define an EXTRACT-category in props.conf with the regular expression
category="(?<category>[^"]*?)"
or for the second do something like
category=(?<category>.+?)\s+new_field
See here for the documentation on how to do those extractions.
This can be done pretty easily if you know when the value ends, i.e. if you know these values are enclosed in some special characters (like category="audit global ... exception") or if you know how the next field name is (like category=audit global ... exception next_field=). For the first case, define an EXTRACT-category in props.conf with the regular expression
category="(?<category>[^"]*?)"
or for the second do something like
category=(?<category>.+?)\s+new_field
See here for the documentation on how to do those extractions.
Perfect! Thank you.
hi,
please can you rephrase your question? because I do not compends you well
I have edited the original question, let me know if that helps.
Thank you,
Show us your configuration files
and your Knowledge Objects
.
Hi Woodcock, I've re-phrased my question, it might not have been phrased very clearly.
props only contains a couple of unrelated field extractions and no transforms. Is there something specific you are interested in?