I am trying to get a truncated list of metadata, and cant seem to get the search recognized.
How can i filter certain hosts with a regex pattern against the hostfield returned by a simple metadata search?
|metadata type=hosts index=main
I've tried subsearches, and using various patterns such as this with no luck.
rex field=host "(?P<somehost>somepattern)"
Thanks
Append a regex command:
... | regex host="somepattern"
well that was easy, Thanks. Forgot about using the regex command directly in search.