To remove few details using rex

[sgulhane5]

Hi Team,

I have three below conditions to create a logic according to it.

Case 1: operation="OVERRIDE" should print but not a name="IP BLOCK TYPE",value="Private"

Sample log for IP BLOCK TYPE: 

[name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"] 

Case 2: operation="OVERRIDE" is not present in the logs at all

Sample log for IP BLOCK TYPE: 

[name="IP BLOCK TYPE",value="Public"] 

So for above two conditions I had used  below query to fetched the desired data>>

rex field=_raw "operation=\"(?<IP_Block_Type>.\w+)\"" | where isnotnull(IP_Block_Type)

Case 3: 

Sample log for IP BLOCK TYPE: 

[name="IP BLOCK TYPE",value="Public",descendants_action={option_with_ea:"INHERIT",option_without_ea:"NOT_INHERIT"},operation="OVERRIDE"] 

Case numbers 1 and 2 queries look good because those logs don't contain details like case 3 (e.g. descendants_action={option_with_ea:"INHERIT",option_without_ea:"NOT_INHERIT"}).  I tried the same filter but got to know that query is taking data from 3rd case also which is not required. So basically I don't want to print anything from case number 3. Please help to get the answers for this.

@gcusello 

@Nisha18789  

@ITWhisperer 

Thanks,

[sgulhane5]

@to4kawa I just want to get case number 1, not 3. 3rd case has many other details including operation="OVERRIDE" so don't want this case to be check while using 

rex field=_raw "operation=\"(?<IP_Block_Type>.\w+)\"" | where isnotnull(IP_Block_Type)

[to4kawa]

index=_internal | head 1 | fields _raw | eval _raw="[name=\"IP BLOCK TYPE\",value=\"Public\",descendants_action={option_with_ea:\"INHERIT\",option_without_ea:\"NOT_INHERIT\"},operation=\"OVERRIDE\"] "
| kv

REX is not need, I guess.

[sgulhane5]

@to4kawa Nope.. it is not working