How to create an eval on random data string ?

[mah]

Hi,

My issue is : I want to create a field from random data string (always the same) which is not present in all logs.

The objective is to create a table with a first column which lists all value of "log-group" field AND a second column with binary value which is to say if the random string is present in the log so 1 if not 0  : 

log-group	string presence
test1	1
test2	0
test3	1

For example, my log : 

log-group=test1 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects random data string

log-group=test2 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects 

log-group=test3 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects random data string

How can I do that ? 

[gcusello]

Hi @mah ,

you should try something like this:

index=your_index
| eval string_presence=if(searchmatch(random_data_string),"1","0")
| table log_group string_presence 

Ciao.

Giuseppe

[mah]

Exactly what I needed !  Thanks 😉

[gcusello · Accepted solution]

Hi @mah ,

good!

for the other people of Community, if this answer solves your need, please accept solution and eventually Karma Points are appreciated.

Ciao and next time.

Giuseppe