Hi, i use regex to extract fields
My query is
| rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Task_Name, ComputerName,Command,_time,Arguments |dedup Task_Name, ComputerName,Command,_time,Arguments
How can i return results if Arguments field is not exist? For example:
...some xml log....
<Command>C:\Windows\System32\wevtutil.exe</Command>
<Arguments>sl Microsoft-Windows-PrintService/Operational /e:true</Arguments>
...some xml log....
Is Ok
And
...some xml log....
<Command>C:\Windows\System32\wevtutil.exe</Command>
...some xml log....
Is not OK.
Hi @Dalador,
if you share your search I could be more prefice.
Anyway, you have to manage the absence of a field at search level, e.g. putting a fixed value for the missing fields (e.g. | fillnull arguments value="-").
Otherwise commands as stats or dedup don't consider in the search the events with a missing field.
Ciao.
Giuseppe
Hi Dalador,
You can try using the keepempty in the dedup:
| rex field=_raw "Command\>(?<Command>[^\<]*)"
| rex field=_raw "Arguments\>(?< Arguments >[^\<]*)"
| table Task_Name, ComputerName,Command,_time,Arguments
| dedup Task_Name, ComputerName,Command,_time,Arguments keepempty=true
Or you can try to use the fill null command:
| rex field=_raw "Command\>(?<Command>[^\<]*)"
| rex field=_raw "Arguments\>(?< Arguments >[^\<]*)"
| table Task_Name, ComputerName,Command,_time,Arguments
| fillnull value="none"
| dedup Task_Name, ComputerName,Command,_time,Arguments
Hi @Dalador,
if you share your search I could be more prefice.
Anyway, you have to manage the absence of a field at search level, e.g. putting a fixed value for the missing fields (e.g. | fillnull arguments value="-").
Otherwise commands as stats or dedup don't consider in the search the events with a missing field.
Ciao.
Giuseppe
This works for me, Thanks!