how to extract a field where there are different values, but which has not determined a value.

[jfeitosa_real]

Hello everyone!

how to extract a field where there are different values, but which has not determined a value.
I need to extract the values from the "Domain" field excluding the "Corp" and "Corp - West" values, but show me the rest.

Domain = "Corp - West \ **OfficeABC \ Server *"*
Domain = "Corp \ **OfficeXYZ \ Workstations *"*
Domain = "Default *"*

Ex. Log:

2020-04-06 18:54:30.000,
_time="2020-04-06 18:54:30.0", ComputarName="XYZ001", Usuer="userx",
Domain="Corp\OfficeXYZ\Workstations\",
IP="54.110.130.34"

2020-04-06 18:59:10.000,
_time="2020-04-06 18:59:10.0", ComputarName="XYZ101", Usuer="usera",
Domain="Corp -
West\OfficeABC\Servers\",
IP="38.230.86.56"

2020-04-06 19:09:30.000,
_time="2020-04-06 19:09:30.0", ComputarName="XYZ201", Usuer="userb",
Domain="Default\", IP="179.28.186.78"

Thanks in advance.

James._/\_

[jfeitosa_real · Accepted solution]

I found the solution and I want to share it with you.

Domain=\"(?:(?:Corp - West|Corp))?(?DomainNew>.*?)\"

Worked perfectly.

Thanks.

James\0/

[manjunathmeti]

If domain field is extracted in index then try this,

index=INDEXNAME | rex field=Domain "\"(Corp\s-\s\w+|Corp)?(?<domain>[\w\\\]+)\"" | fields Domain, domain

else,

index=INDEXNAME | rex "Domain=\"(Corp\s-\s\w+|Corp)?(?<domain>[\w\\\]+)\"" | table _raw, domain