I have a line that contains 2 different fields that I need
Right now I have:
index=os sourcetype="xxx" | regex _raw="\d tests, \d assertions, \d failures, \d errors"
Which returns for example:
2 tests, 2 assertions, 0 failures, 0 errors
How can I extract the fields tests and failures? would it be possible?
I'm guessing this:
... | rex "(?<tests>\d+) tests, (?<assertions>\d+) assertions, (?<failures>\d+) failures, (?<errors>\d+) errors"
However, without seeing your actual events that's only that, a guess.