Hello, I have the following:
11/20/2014 11:04:58 AM
LogName=Security
SourceName=AD FS 2.0 Auditing
EventCode=501
.
.
.
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip
1.1.1.1
.
.
.
.
How can I construct a query to get the IP address in the result ? I am looking for a way to get data in the line after http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip
Use a Regex, like that:
index=bla "something to search" | rex field=_raw "x-ms-forwarded-client-ip (?P<clientIP>(\d{1,3}\.){3}\d{1,3})"
Now you can see that a new field, named clientIP
, will be available for you.
Cheers,