hi,
i wanted to fetch some information from my logs. here is the scenario:
index=xyz host=xxx.com source="/as/df/gh/*.log" "[error]"
| rex field=_raw "LoadPlanName:\s(?P<LP_Name>[^\]]*)"
| table LP_Name
| dedup LP_Name
above query gives me the result as below
LP_Name
LP_abc
LP_abc1
LP_abc2
now from the same source i want to fetch other details for the LP_Name extracted above i.e LP_abc, LP_abc1, LP_abc2, for that i tried to create below query which is not working:
index=xyz host=xxx.com source="/dir1/dir2/*.log" "[error]"
| rex field=_raw "LoadPlanName:\s(?P<LP_Name>[^\]]*)"
| table LP_Name
| dedup LP_Name
| map search = "search index=xyz host=xxx.com source="/dir1/dir2/*.log" "[completed]"
| rex field=_raw "LoadPlanName:\s(?P<LPN>[^\]]*)"
LPN=$LP_Name"
For above query i have been getting below error:
Error in 'SearchParser': Missing a search command before '^'. Error at position '417' of search query 'search index=oitp host=ITCNCHN-LX4* source="/opt/o...{snipped} {errorcontext = s(?P<LPN>[^\]]*)" L}'.
i have been struggling with it from a long time now, need help to get the the data that i desired. Thanks in advance.
