How to return all results if field is not exist?

[Dalador]

Hi, i use regex to extract fields 
My query is
 | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Task_Name, ComputerName,Command,_time,Arguments |dedup Task_Name, ComputerName,Command,_time,Arguments

How can i return results if Arguments field is not exist? For example: 

...some xml log....
<Command>C:\Windows\System32\wevtutil.exe</Command>
<Arguments>sl Microsoft-Windows-PrintService/Operational /e:true</Arguments>
...some xml log....

Is Ok


And 

...some xml log....
<Command>C:\Windows\System32\wevtutil.exe</Command>
...some xml log....

Is not OK. 

[diogofgm]

Hi Dalador,

You can try using the keepempty in the dedup:

| rex field=_raw "Command\>(?<Command>[^\<]*)" 
| rex field=_raw "Arguments\>(?< Arguments >[^\<]*)" 
| table Task_Name, ComputerName,Command,_time,Arguments 
| dedup Task_Name, ComputerName,Command,_time,Arguments keepempty=true 

Or you can try to use the fill null command:

| rex field=_raw "Command\>(?<Command>[^\<]*)" 
| rex field=_raw "Arguments\>(?< Arguments >[^\<]*)" 
| table Task_Name, ComputerName,Command,_time,Arguments
| fillnull value="none" 
| dedup Task_Name, ComputerName,Command,_time,Arguments

[gcusello · Accepted solution]

Hi @Dalador,

if you share your search I could be more prefice.

Anyway, you have to manage the absence of a field at search level, e.g. putting a fixed value for the missing fields (e.g. | fillnull arguments value="-").

Otherwise commands as stats or dedup don't consider in the search the events with a missing field.

Ciao.

Giuseppe

[Dalador]

This works for me, Thanks!