Need help in building a search. Below is my log file events format:
Event 1 -- RequestType1
Event 2 -- RequestType2
Event 3 -- Error Reply for RequestType1
Event 4 -- Success Reply for RequestType2
Now I have to formulate a search to match Event 3 with Event 1 & Event 4 with Event 2.
Note: If it is an error, no unique field will be there to match with Request Type1.
Kindly help me out on this.
Try to formulate a search with following commands since you know better about the events and then shout in case you need any help
and look for similar questions
May be easier to extract the value for
requesttype in to a field using something like this and then group, sort is one example of grouping. Best approach would depend on what you intend to do with the results. The regex below assumes request type is always at the end.
..| rex "\b(?<rt>\w+)\b$" | sort rt