List of policies:
policy1
policy2
policy3
Another list:
something1
something2
How can I extract the each name of policy (so that I can put them into multi-value fields)?
Essentially I would need a regex statement that captures every line under "List of policies:" until the empty line that divides the lists.
Try this :
...|rex max_match=0 "-\sPolicy\s'(?<Policy>[^']+)'[^)]+"
Policies with no targets attached:
SeacoDR_Weekly (user: LGAdmin)
Old_CCI_CCP_11Min (user: LGAdmin)
CCI_SAP_Monthly_Full (user: LGAdmin)
CCI_AMI (user: LGAdmin)
CCI_MDM_Monthly (user: LGAdmin)
CCI_CRM_Monthly (user: LGAdmin)
CCI_SAP_ERP_15min_log (user: LGAdmin)
CCI_SAP_ERP_Weekly (user: LGAdmin)
CCI_SAP_ERP_Monthly (user: LGAdmin)
CCI_SAP_ERP_Yearly (user: LGAdmin)
MG_EPOS_DAILY_PROD (user: LGAdmin)
MG_SAP_DEV_QA_LOG (user: LGAdmin)
CUP_DB_cupbopdb01 (user: LGAdmin)
Indivior_WEB_Daily (user: LGAdmin)
Seaco_Weekly (user: Seaco_CPM)
Warning - Missing backups in following policies:
- Policy 'CCI_GRC_11Min' (user:'LGAdmin',account:'CCI')
- Policy 'CCI_Voyage_INT_12min_Backup_Volumes' (user:'LGAdmin',account:'CCI')
- Policy 'CCI_BOFC_12min' (user:'LGAdmin',account:'CCI')
- Policy 'CCI_BW_12min_Log' (user:'LGAdmin',account:'CCI')
- Policy 'CCI_Arete_12min' (user:'LGAdmin',account:'CCI')
- Policy 'MG_SAP_PRD_DB_11min' (user:'LGAdmin',account:'XXX')
- Policy 'BW_HANAdata' (user:'LGAdmin',account:'XXX')
- Policy 'CUP_DB_cuperpdb01' (user:'LGAdmin',account:'CUP')
- Policy 'CUP_DB_cupotpdb03' (user:'LGAdmin',account:'CUP')
Fragment of the event, can't add the entire thing but the event has a part that is json formated and these list are in one of the objects.