This query capture the id from logs and make a search in the database, when there is a id value in logs it works well, if there is no id value the map condition trigger an error
Error in 'map': Did not find value for required attribute 'id'.
query
index=*sourcetype=* "Invalid"
| rex field=_raw ".*for\sinvalid\s(?<id>.*?(?=:))"
| table id
| where !isnull(id)
| map maxsearches=5 search="dbxquery query=\"select id, name,cell,email, date from idx where id='$id$'\" connection=sql"
Is it possible to trigger dbxquery only when there is a id value ?
You can avoid returning an error by using fillnull
to populate the field with an empty string:
index=*sourcetype=* "Invalid"
| rex field=_raw ".*for\sinvalid\s(?<id>.*?(?=:))"
| table id
| fillnull value="" id
| map maxsearches=5 search="dbxquery query=\"select id, name,cell,email, date from idx where id='$id$'\" connection=sql"
You can avoid returning an error by using fillnull
to populate the field with an empty string:
index=*sourcetype=* "Invalid"
| rex field=_raw ".*for\sinvalid\s(?<id>.*?(?=:))"
| table id
| fillnull value="" id
| map maxsearches=5 search="dbxquery query=\"select id, name,cell,email, date from idx where id='$id$'\" connection=sql"