Hi,
My issue is : I want to create a field from random data string (always the same) which is not present in all logs.
The objective is to create a table with a first column which lists all value of "log-group" field AND a second column with binary value which is to say if the random string is present in the log so 1 if not 0 :
log-group | string presence |
test1 | 1 |
test2 | 0 |
test3 | 1 |
For example, my log :
log-group=test1 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects random data string
log-group=test2 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects
log-group=test3 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects random data string
How can I do that ?
Hi @mah ,
good!
for the other people of Community, if this answer solves your need, please accept solution and eventually Karma Points are appreciated.
Ciao and next time.
Giuseppe
Hi @mah ,
you should try something like this:
index=your_index
| eval string_presence=if(searchmatch(random_data_string),"1","0")
| table log_group string_presence
Ciao.
Giuseppe
Exactly what I needed ! Thanks 😉
Hi @mah ,
good!
for the other people of Community, if this answer solves your need, please accept solution and eventually Karma Points are appreciated.
Ciao and next time.
Giuseppe