Firstly, I'm not sure whether this is even possible, but I wonder whether someone may be able to help me please.
I've put together the following search:
index=main auditSource=contact-frontend auditType=ServiceReceivedRequest detail.referrer!="-" OR detail.requestBody!="" |rex field="detail.requestBody" "(?<selectservice>[^\=]+)" |rex field="detail.requestBody" "error=(?<servicecomments>[^\=]+)" |eval servicecomments=replace(servicecomments, "\+", " ") |rex field="detail.requestBody" "error=(?<reportcomments>[^$]+)\&is" |eval reportcomments=replace(reportcomments, "\+", " ") |rex field="detail.requestBody" "action=(?<csrfcomments>[^$]+)\&is" |eval csrfcomments=replace(csrfcomments, "\+", " ")
In its current form, there are three fields which extract comments. These are servicecomments, reportcomments and csrfcomments which are three separate fields in my results table.
What I'd like to do is amalgamate the comments fields to one, but then have an 'if statement' so if the "selectservice" field
This then means that the comments would appear in one field rather than three separate ones.
I did try the following to test two of the fields, but it didn't work.
I just wondered whether someone may be able to look at this please and offer some guidance on how I may achieve this.
Many thanks and kind regards
This is what I would do:
| eval comments = case ( selectservice == "service", servicecomments, selectservice == "report-name", reportcomments, selectservice == "csrf", csrfcomments ) | fields - servicecomments, reportcomments, csrfcomments
Hope that helps
Hi @javiergn, thank you very much for taking the time to help me with this.
The solution works great!