I have to display the counters starting with # and also % if the sourcetype is "PerfmonMk:.Net CLR Exceptions" and for other sourcetype(PerfmonMk:Processor) i have to display the counters starting with % only. I use the following regex commands,
Counters starting with # and % : | regex column="#[_A-Za-z]*|%[_A-Za-z]*" Counters starting with % : | regex column="%[_A-Za-z]*"
Is there any way to do this?
Just construct the one regex to match all your cases. I can't see what the issue is with matching
[#%][_A-Za-z]* (which is just a contraction of your first example regex). If hash is never present, what's the big deal? The regex will still match.
OK, I think I misunderstood your question initially, and my first suggestion isn't really valid. But the second one should help a bit:
sourcetype="PerfmonMk:Processor" | table sourcetype %* | append [search sourcetype="PerfmonMk:.Net CLR Exceptions" | table #* %*]
The problem with field names is that they can only be referred to by wildcards, not by regex. Hopefully this will work well enough for you.
You could use the single regex as described, and then use a 'where' clause to eliminate the events you don't want.
You could run two different searches with your two different regexes and use 'append' to turn them into a single result set.
If i write single regex command and select sourcetype as "PerfmonMk:Processor" then the counters starting with # will get displayed. I don't need that. Only if i select the sourcetype "PerfmonMk:.Net CLR Exceptions" the counters that starts with # should get displayed.