I have some data that looks like this:
What I need to do is analyze field1 through field45 (the number may change) to see if they all equal 'OK'. If not 'OK' then alert. The field names do not all start with the same thing (so no field*).
I can, however, do something like this in the search:
| rex "(?i)line=[\d]\w(?P
This is kinda giving me the data I want, but not really, and I haven't been able to figure out how to check every kv pair if the value is 'OK' for all of them.
how about instead of putting them in a seperate field, use the same field.?
how about instead of putting them in a seperate field, use the same field.?
I won't know the exact numbers, so counting is out. Looking for =[^O] is a great idea, however. I'm going to play around with that...
ok, I was think about this a different way, could you take your list of fields as just one field and search to see if you have a regex of '=[^O]' ?