Hi,
I want to filter the below rex value in where clause but its not working.
| rex field=_raw ":[ ]*(?<error>[^:]+$)"
| where error="No route to host (Host unreachable)"
Kindly suggest.
Thanks in advance!
Hi Champion,
Thanks for the information!
Can you please share the exact query which should work, I tried with both like and match but its not working.
Thanks!