Hi,
Best way for me to explain is by example.
example search:
host=*guac* sourcetype="syslog" | rex field=_raw "guacd\[(?<guacd>\d+)\]" | rex field=_raw "connected-listener: id=\"(?<connection_id>.+)\" email=" | search "5b629c6f-4b1a-410a-9382-53d694c23972" OR guacd=10734
I added the last search filter just for clarity to get a small result set.
Example result set:
Whenever I get a string like "Error writing data to socket", I want to append the email to that result which can be found if correlated with the guacd field and then with the connection_id field
Not sure how to do it.
Any idea?
Try something like this
host=*guac* sourcetype="syslog" | rex field=_raw "guacd\[(?<guacd>\d+)\]" | rex field=_raw "Connection ID is \"(?<connection_id>.+)\"" | eventstats values(connection_id) as connection_id by guacd| rex field=_raw "connected-listener: id=\"(?<connection_id2>.+)\" email=(?<email>.+)" | eval connection_id=colesce(connection_id2,connection_id) | search connection_id="5b629c6f-4b1a-410a-9382-53d694c23972" guacd=10734 | eventstats values(email) as email by guacd connection_id| table _time _raw guacd connection_id email
small fix for the example query (same result set):
host=guac sourcetype="syslog" | rex field=_raw "guacd[(?\d+)]" | rex field=_raw "connected-listener: id=\"(?.+)\" email=" | rex field=_raw "Connection ID is \"(?.+)\"" | search "5b629c6f-4b1a-410a-9382-53d694c23972" OR guacd=10734 | table _time _raw guacd connection_id