How can I search to filter?

[sekhar463]

hai All,

i have events like below 

from how can i filter events if for ex: 6th character in C*E**M  IS M want to filter all OR 6th character is H how can i filter all those

please assist

C*E**M****} JAWS Process to copy the legacy Virtu ORDERDETAILSs data from IMFT to network folder
C*E**M****} JAWS Process to copy the legacy Virtu Orders data from IMFT to network folder
C*E**M****} box that contains the processes to load Portware EOD files to APP_ETT database
C*E**M****} box that load the OMS legacy tables 1 11.111%
C*E3VL****} Box that contains the jobs to download and process the ITG Placement Inbound file
C*E**H****}ox that contains the processes t

[scelikok]

You can filter using two methods, 

index=index_name source=sourcetype 
| regex _raw="DESCRIPTION=\".{5}(?:M|H)" 
| table JOID,JOB_NAME,DESCRIPTION,JOB_GROUP,STATUS,LAST_START,LAST_END,NEXT_START,RUNTIME
| sort -time

Or,

index=index_name source=sourcetype 
| rex "DESCRIPTION=\".{5}(?<sixth_char>.)"
| table JOID,JOB_NAME,sixth_char,DESCRIPTION,JOB_GROUP,STATUS,LAST_START,LAST_END,NEXT_START,RUNTIME
| search sixth_char IN ("H","M")
| sort -time

[scelikok]

Hi @sekhar463,

I thought that you wanted to extract the sixth char, please try below to filter,

| regex _raw="DESCRIPTION=\".{5}(?:M|H)"

[sekhar463]

not getting results

[scelikok]

Hi @sekhar463,

You use below to extract 6th char in events;

| rex "^.{5}(?<sixth_char>.)"

[sekhar463]

while adding this regex its giving 0 

actually once extracted i want to create 

can you give me the correct query please. i am using below query

index=index_name source=sourcetype | rex "^.{5}(?<sixth_char>.)"
| table JOID,JOB_NAME,sixth_char,DESCRIPTION,JOB_GROUP,STATUS,LAST_START,LAST_END,NEXT_START,RUNTIME
| sort -time

[sekhar463]

getting Zero while executing 

sample event

2023-01-16 03:30:01.715, JOID="80562", NAME="jobs name", DESCRIPTION="C***VM****}  extracting crd data from CS_BROKER table for ", JOB_NAME="job name",  RUN_NUM="408972404", NTRY="1", AVG_RUN_TIME="34",  STATUS_CODE="4", STATUS="SUCCESS", STATUS_TIME="2023/01/13 17:04:03", LAST_START="2023/01/13 17:03:29", LAST_END="2023/01/13 17:04:02", DATE_CONDITIONS="0", RUNTIME="33", EXIT_CODE="0"