Search for Multiples Values and extract them into a single field?

[ito27]

Can you please help me to figure out how can I extract multiple values in a source and extract them into a single field?

For example, how can I make these two values that I am searching to be extracted to a field named "web_brwoser":

sourcetype="iis-369" | rex field=_raw "(?P\W\w\w\w\w\w\w\W\d\d\d\W\d\d\s\d\d\d),(?:\W\w\w\w\w\W\d\W\d)"

Do I have to type "AND" between the two values? I tried it already and it did not work.
Also, I tried to type "|" = "or" and it don't work either.

[bjoernjensen]

Hey there,

this depends a little on how you would like those values to be shown. Assuming you would like to have a multi value field something like this should work:

sourcetype="iis-369" | rex field=_raw "(?WwwwwwwWdddWddsddd)" | rex field=_raw "(?WwwwwWdWd)" | eval web_browser = field1 + ":" + field2 | makemv delim=":" web_browser | table _time web_browser _raw

This runs rex twice and builds the mv field 'web_browser' using ':' as separator. You should of course be sure your rex does not match that delimiter.

[ito27]

How can I search for all the values needed and extract them in different fields at the same time? So, the command log get saved by the time I work with the second field. Because there is where my problem come up doing everything at once. For example I type AND or OR in the search bar but it gave me an error because I have duplicated commands.

[jstockamp]

To combine two fields you can use "eval combined_field = field1 ."-". field2" - that will combine them with a hyphen between.

[bjoernjensen]

Sample data would be very useful. I guess there should be some (regex) way to match "all values needed" inspecting the vicinity.

[jstockamp]

I'm having a hard time understanding what you're trying to do. Maybe posting some sample data would be useful. You can easily extract multiple fields in a single rex command.

[ito27]

How can I search for all the values needed and extract them in different fields at the same time? So, the command log get saved by the time I work with the second field. Because there is where my problem come up doing everything at once. For example I type AND or OR in the search bar but it gave me an error because I have duplicated commands.