2020-10-19 05:00:03,744 INFO main() Deletion list: ['user1', 'user2', '$template', 'user233', 'svc_user1', ]
I have this log file that outputs a list of users to be deleted.
I want to search this output and extract the users into fields then exclude the $template* & svc_users* users.
I have tried this to extract the users to field.
search "list:" | eval del_users=split(_raw,"', '") | table del_users
output looks like:
Any suggestions to get a better output or how I should be doing this?
Hi
Try this
| rex field=log max_match=0 "\[{0,}\'(?P<output>[^',]+)"
| mvexpand output
| table output
This looks like what I need.
|search "list:" | rex field=log "\[(?<del_users>.*)\, \]" | eval users=split(_raw,"', '") | mvexpand users
|search NOT users IN ("$*templat*","svc*") | table users
Hi
Try this
| rex field=log max_match=0 "\[{0,}\'(?P<output>[^',]+)"
| mvexpand output
| table output
did you check the "rex" regular expression...
| makeresults
| eval log="2020-10-19 05:00:03,744 INFO main() Deletion list: ['user1', 'user2', '$template', 'user233', 'svc_user1', ]"
| rex field=log "\[(?<del_users>.*)\, \]"
| table del_users
EDIT - verified and adding the screenshot: