How can I use a subsearch as fields in my report?

[qtopia7100]

This is the search I'm working with:

index="*-network" (sourcetype="cisco:asa" OR sourcetype="routers") user="user*" ("session terminated" OR "session started") | table _time, user, src_ip

I want a field that has "session terminated" OR "session started" based on which value is in the log.

[gokadroid]

Please try this:

index="*-network" (sourcetype="cisco:asa" OR sourcetype="routers") user="user*" ("session terminated" OR "session started") 
| rex field=_raw ".*(?<sessionState>(session\s*(terminated|started))).*"
| table _time, user, src_ip, sessionState

See the extraction here

If you want to make it case insensitive like the search bar will do try (?i) in rex :

...| rex field=_raw ".*(?<sessionState>(?i)(session\s*(terminated|started))).*"| ...