Hi all,
So I'm currently using this extraction:
| rex "(?m)Package:\s+SEA.ha(?:\n|.)*?MS:(?<MS>\s+\d+\-\d+\S\S+)"
However I have found that this is not always present in my data, so I was wondering if there was a way where I could run this (below) rex command only when the first one doesn't find anything?
"| rex "(?m)(?:\n|.)MS:(?<MS>\s+\S+)"
Thank you.
Can you provide some sample logs for both patterns?
One dirty workaround would be like this
| rex "(?m)Package:\s+SEA.ha(?:\n|.)*?MS:(?<MS>\s+\d+\-\d+\S\S+)" | rex "(?m)(?:\n|.)MS:(?<MS1>\s+\S+)" | eval MS=coalesce(MS,MS1)
Can you provide some sample logs for both patterns?
One dirty workaround would be like this
| rex "(?m)Package:\s+SEA.ha(?:\n|.)*?MS:(?<MS>\s+\d+\-\d+\S\S+)" | rex "(?m)(?:\n|.)MS:(?<MS1>\s+\S+)" | eval MS=coalesce(MS,MS1)
That worked great! thank you
If you would like to convert it as an answer I'll accept it for you
Here you go.