Hello all,
I'd like to compare events in the same log files, amusing the format of the events are the same. For example:
event1: ccc, ddd
event2: bbb, ccc
event3: aaa, bbb
As you can see there's a pattern, the 2nd part (bbb) in event3 is always the same as the 1st part in event2, and the 2nd part in event 2 (ccc) is always the same as the 1st part in event 1.
My question is how do I check if all the events in the same log file match this pattern. Thank you in advance!
Sincerely,
Gai
Assuming you have fields called field1 and field2, and your events are already in the order you want to compare.
| streamstats window=2 current=f values(field1) as previous_field1
| eval match2withprevious1=if(field2=previous_field1,"match","not match")
Hi @gaishi,
if you want to check the presence of a predefined pattern (e.g. "bbb"), you could run something like this:
index=your_index
| eval check=if(searchmatch("bbb"),"yes","not")
| table _time _raw check
If instead you want to check the patterns in your logs, there's a tab in the search dashboard.
Ciao.
Giuseppe