Hi all,
i tried get rid of my workaround solution with adding
| collect index=test testmode=true
to my searches. The above command is creating a _raw Field with all Fields from my (stats) search, so i didnt need to specify all my fields to a new aggregated one. I need all Fields=Value Pairs in one Field because i set up a alert action for each saved_search and with an standard field $result._raw$ it's easier to apply this to many Searches(250+).
Aggregating with collect:
| makeresults count=2
| eval src="1.1.1.1", dest="10.10.10.10", dest_port="123", eventCount=random()
| eval eventDetails="Source=" . src . " " . "Destination=" . dest . " " . "Port=" . dest_port . " " . "eventCount=" . eventCount
| collect index=test testmode=true
Aggregating with foreach:
| makeresults count=2
| eval src="1.1.1.1", dest="10.10.10.10", dest_port="123", eventCount=random()
| eval eventDetails="Source=" . src . " " . "Destination=" . dest . " " . "Port=" . dest_port . " " . "eventCount=" . eventCount
| eval x_raw=""
| foreach * [ eval x_raw="<<FIELD>>"+"="+'<<FIELD>>' + ", " + x_raw]
my x_raw field contains the fields twice, i was not able to get a result like a _raw Field from my "| collect" workaround.
x_raw=src=1.1.1.1, eventDetails=Source=1.1.1.1 Destination=10.10.10.10 Port=123 eventCount=607756396, eventCount=607756396, dest_port=123, dest=10.10.10.10, , src=1.1.1.1, eventDetails=Source=1.1.1.1 Destination=10.10.10.10 Port=123 eventCount=607756396, eventCount=607756396, dest_port=123, dest=10.10.10.10,
Any Ideas how to solve this?
