Hi all,
There is a way to consolidate two fields?
For example, I have the following event:
"CEF:0|IMPERVA|SecureSphere|9.0.0|Firewall: eventID=233215 act=none proto=tcp cs1=mozilla cs1lable=firefox"
The meaning of cs1 is = Custom string1
I want to consolidate the fields cs1=mozilla and cs1lable=firefox to a new field . for example: User-Agent=mozilla_firefox
And If it possible to set it globally.
???
10x
First extract fields before the concatenation:
...|rex field=_raw "cs1\=(?<field1>\S)\s+cs1lable\=(?<field2>[^\n])"|eval user_agent=field1+"_"+field2|table user_agent
Hi Bugnet, i hope what you want is a concatenation. if yes try this:
... | strcat cs1 "_" cs1lable User-Agent
doing so will give you the expected result if your fields cs1 and cs1lable are extracted fields