Extracting a value from log message

[sahana]

Hi,

I have a requirement like i need to extract a some card value which was present inside the message body of the log. In this value would come to logs in two different names. Can you please how can i fetch these value and display it in  table.

thanks

[isoutamo]

Hi

Without examples from your data it's hard to show how this exactly can do. But in general level you can do it with eval and e.g. case/if/coalesce  like this.

| eval field = coalesce(f1, f2)
| eval field = if (index=="ix1", f1, f2)
| table field

Select one of those evals based on your data or change names etc.

r. Ismo