How do I edit the regex in my search to extract a part of a string?

[kumina]

I have a log:

 BL: | LL: INFO | TS: 1234 | AR: RxC_16.00.37.01 | STORE:  :BROADCAST |
 USER: BROADCAST | HOST: BROADCAST | APPSERVER: rri | MSGID: CINTERFACE
 |SC: [Profile] | MSG: ISP Broadcast Received for

I want to get MSGID-SC (CINTERFACE-Profile) from the string above.

For this i am trying to use rex command:

index=rx_connect "USER: BROADCAST" |rex field=_raw
"MSGID:\s(?<MSGID>[^\|]*)\s\|\SC:\s\[(?<SC>[^\]]*)\]" | eval
someNewField=MSGID."-".SC`

But it is not working. Please suggest further.

[chimell]

Hi kumina

If msgid and sc are not constant , use the max_match option and mvindex command to solve your problem

Try this search code

 index=rx_connect "USER: BROADCAST"|rex field=_raw  max_match=0 "\|\s\w+\:\s(?P<msgid1>[^\|]+)\s"|eval msgid=mvindex(msgid1,7)
|rex field=_raw "\[(?P<sc>[^\|]+)\]"|rex field=_raw "\|\s(?P<field1>[\w]+)\:\sCINTERFACE"|rex field=_raw "\|(?P<field2>[\w]+)\:\s\[Profile]"|eval someNewField = field1."-".field2."  (".msgid."-".sc.")" 
|table msgid sc field1 field2 someNewField

see result

[chimell]

Hi kumina

Try this search code it works well

 index=rx_connect "USER: BROADCAST" |rex field=_raw "MSGID:\s(?P<msgid>[^\|]+)\s"|rex field=_raw "SC:\s\[(?P<sc>[^\|]+)\]"|rex field=_raw "\|\s(?P<field1>[\w]+)\:\sCINTERFACE"|rex field=_raw "\|(?P<field2>[\w]+)\:\s\[Profile]"|eval someNewField = field1."-".field2."  (".msgid."-".sc.")" |table msgid sc field1 field2 someNewField

Look at the following screen capture

[chimell]

Thanks too .
Test the second result and think to vote and accept

[kumina]

Thanks Chimell....
Now it works

[kumina]

Hi,

If value of msgid and sc in above logs is not constant and we want to extract that part then what will be the string

[alacercogitatus]

Your regex has a Typo. Try this:

index=rx_connect "USER: BROADCAST" |rex field=_raw "MSGID:\s(?<msgid>[^\|]+)\s\|SC:\s\[(?<sc>[^\]]*)\]" | eval someNewField = msgid."-".sc

[kumina]

Hi,

I am still getting whole logs instead of

MSGID-SC

example:(CINTERFACE-Profile)