- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Substituting key values on raw text
responsys_cm
Builder
02-01-2022
04:22 PM
Let's say I have a CSV input with the following columns: _raw,user,src_ip
The _raw event is: "Accepted public key for user $user$ from $src_ip$"
Is there a way to replace $user$ and $src_ip$ in _raw with the values of the corresponding fields?
I tried using "foreach" and "rex" in sedcmd mode, but it doesn't look like rex understands <<FIELD>> and '<<FIELD>>'.
Is there another way to do this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
johnhuang
Motivator
02-01-2022
06:09 PM
Assuming you're running this during search time.
Quick and dirty:
| eval _raw="Accepted public key for user ".user." from ".src_ip
Dynamic:
| foreach user src_ip [eval _raw=replace(_raw, "\$<<FIELD>>\$", '<<FIELD>>')]
