Raw data only parsing the first instance

[praddasg]

Hello All,

I have a data like this

X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]

Now when I am using the query <search criteria> | table status, reason it is giving values "X" and "Y"
1. Trying to understand why it is not considering the values Z & Y and xyz & abc
2. If I have to get the result of values Z & Y and xyz & abc how to retrieve?

[to4kawa]

sample query:

| makeresults
| eval _raw="service: mnp, o=123, X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]"
| rex max_match=0 "status=(?<status>\w+), reason=(?<reason>\w+)"
| table status reason
| eval _counter = mvrange(0,mvcount(status))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _*

recommend:

<search criteria> 
| rex max_match=0 "status=(?<status>\w+), reason=(?<reason>\w+)"
| fields status reason
| eval _counter = mvrange(0,mvcount(status))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _*
| table status, reason

[praddasg]

Hello @to4kawa
It is still giving me values "X" and "Y"

[to4kawa]

use where OR search

[praddasg]

I am only using where but still the same

[to4kawa]

I see, your query is wrong

[praddasg]

Hi @to4kawa
can you please explain a bit more when you say the query is wrong? What I meant above is in the complete query I am not using search instead using where

service
| where not reason like "%P%"
|table status, reason

[to4kawa]

| where not reason like "%P%" 

This can't work.
where "%P%" come from?
Don't you select NOT (status="X" AND reason="Y")?

[richgalloway]

What is <search criteria>?

[praddasg]

Hi @richgalloway the raw data is like service: mnp, o=123, X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]

and my <search criteria> is service