How to remove value in event field?

[lehoang47tin]

Hi, I have processes logs like this:
event1:

{"snapshot":[{"name":"systemd"},{"name":"gvfsd-trash"},{"name":"gvfsd-metadata"},{"name":"qterminal"},{"name":"bash"},{"name":"systemd-journal"},{"name":"systemd-udevd"},],"action":"snapshot"}

event2:

{"snapshot":[{"name":"systemd"},{"name":"gvfsd-trash"},{"name":"bash"},{"name":"systemd-journal"},{"name":"systemd-udevd"},],"action":"snapshot"}

How do I stats all of name except "systemd*" processes? Output is:

"gvfsd-trash", "gvfsd-metadata","qterminal", "bash"

Thanks.

[jadengoho]

You can do Search Command

| makeresults 
    | eval value="{\"snapshot\":[{\"name\":\"systemd\"},{\"name\":\"gvfsd-trash\"},{\"name\":\"gvfsd-metadata\"},{\"name\":\"qterminal\"},{\"name\":\"bash\"},{\"name\":\"systemd-journal\"},{\"name\":\"systemd-udevd\"},],\"action\":\"snapshot\"}
    {\"snapshot\":[{\"name\":\"systemd\"},{\"name\":\"gvfsd-trash\"},{\"name\":\"bash\"},{\"name\":\"systemd-journal\"},{\"name\":\"systemd-udevd\"},],\"action\":\"snapshot\"}" 
    | rex field=value "name\"\:\"(?<Name>[^\"]+)" max_match=20 
    | table Name 
    | mvexpand Name 
    | stats count by Name 

OR Dont include it using regex

| makeresults 
| eval value="{\"snapshot\":[{\"name\":\"systemd\"},{\"name\":\"gvfsd-trash\"},{\"name\":\"gvfsd-metadata\"},{\"name\":\"qterminal\"},{\"name\":\"bash\"},{\"name\":\"systemd-journal\"},{\"name\":\"systemd-udevd\"},],\"action\":\"snapshot\"}
{\"snapshot\":[{\"name\":\"systemd\"},{\"name\":\"gvfsd-trash\"},{\"name\":\"bash\"},{\"name\":\"systemd-journal\"},{\"name\":\"systemd-udevd\"},],\"action\":\"snapshot\"}" 
| rex field=value "name\"\:\"(systemd\")*(?<Name>[\w\-]*)" max_match=20 
| table Name 
| mvexpand Name 
| stats count by Name