In search - Dynamic REX loading.

[cpm003]

Hello,

I´m trying to load custom rex field extraction if another field has a certain value, for example:

if logtype=system
     then

               search | rex field=_raw .....

if logtype= application
      then
               search | rex field=_raw ....

logtype	username	_raw
system		user=002
application		suser=004

Thanks in advance!

[richgalloway]

Try something like this run-anywhere example.  I'll leave to you get the logtype field into the subsearch.

| makeresults | eval _raw="This event contains user=002 so it should match system logtypes" 
| regex _raw=[|makeresults | eval logtype="system" | eval match=case(logtype="application","user=002", logtype="system","suser=004", 1==1, "XXnoMatchXX") | return $match]

[ITWhisperer]

If the rex doesn't match then the field isn't extracted so why can't you just both rex and let one pick up user= and the other pick up suser=?