I have a log: "TOTAL NUMBER OF RECORDS IS:0"
I need to Query it in a way that it finds a log message if the number of records turns out to be more than 0.
I have tried the following
sourcetype = Mylogs | rex "\d+:\d+:\d+\s(?< TOTAL NUMBER OF RECORDS IS:>\d+)$" | where TOTAL NUMBER OF RECORDS IS:>=25
It gives a terminator Error. I have tried with it does not show up. Is there a way?
I guess your provided log example is just a part of the original event.
Try the following query for your regex:
basesearch | rex "TOTAL NUMBER OF RECORDS IS:(?<totalRecords>\d+)" | where totalRecords >= 25
I guess your provided log example is just a part of the original event.
Try the following query for your regex:
basesearch | rex "TOTAL NUMBER OF RECORDS IS:(?<totalRecords>\d+)" | where totalRecords >= 25
There are a few things wrong with that query.
TOTAL NUMBER OF RECORDS IS:(?<field>\d+)
. You may even get by with :(?\<field>d+)
.Try this query: sourcetype=mylogs | rex ":\d+(?<TotalNumberOfRecords>\d+)" | where TotalNumberOfRecords>=25
That query throws a field too long error
But :(?\<field>d+)
works