My query searches for (Eventcode=509 OR EventCode=118) and generates output (host, Time, EventCode, Task category, Mesaage)
Is it possible to use REPLACE to replace entire message field with another message associated with the EventCode??
Use some conditional logic combined with an eval to get it done
| eval Message=if(Eventcode=509 OR EventCode=118,"Insert new message here",Message)
My query searches for eventcode and displays (host, time, task category, message) i want to use some color to highlight all same hosts generating multiple eventcode??
please help with the query
Use some conditional logic combined with an eval to get it done
| eval Message=if(Eventcode=509 OR EventCode=118,"Insert new message here",Message)
thank you!!! This worked😊😊