How do I get a certain rex field extraction to run if a field equals a specific value?

[IRHM73]

Hi,

Firstly, I'm not sure whether this is even possible, but I wonder whether someone may be able to help me please.

I've put together the following search:

  index=main auditSource=contact-frontend auditType=ServiceReceivedRequest detail.referrer!="-" OR detail.requestBody!=""  
    |rex field="detail.requestBody" "(?<selectservice>[^\=]+)"
    |rex field="detail.requestBody" "error=(?<servicecomments>[^\=]+)"
    |eval servicecomments=replace(servicecomments, "\+", " ") 
    |rex field="detail.requestBody" "error=(?<reportcomments>[^$]+)\&is"
    |eval reportcomments=replace(reportcomments, "\+", " ")
    |rex field="detail.requestBody" "action=(?<csrfcomments>[^$]+)\&is"
    |eval csrfcomments=replace(csrfcomments, "\+", " ")

In its current form, there are three fields which extract comments. These are servicecomments, reportcomments and csrfcomments which are three separate fields in my results table.

What I'd like to do is amalgamate the comments fields to one, but then have an 'if statement' so if the "selectservice" field

• equals "service", then it extracts "servicecomments",
• equals "report-name" then extract "reportcomments"
• equals "csrf" extract "csrfcomments".

This then means that the comments would appear in one field rather than three separate ones.

I did try the following to test two of the fields, but it didn't work.

 |eval comments=if(selectservice="csrfToken",csrfcomments,servicecomments)

I just wondered whether someone may be able to look at this please and offer some guidance on how I may achieve this.

Many thanks and kind regards

Chris

[javiergn · Accepted solution]

This is what I would do:

| eval comments = case (
    selectservice == "service", servicecomments,
    selectservice == "report-name", reportcomments,
    selectservice == "csrf", csrfcomments
)
| fields - servicecomments, reportcomments, csrfcomments

Hope that helps

[IRHM73]

Hi @javiergn, thank you very much for taking the time to help me with this.

The solution works great!

Kind Regards

Chris