matching issue with a regex in search

[rbw78]

Hello,

I'm having an issue with a regex i did.
I want to create a new column with my regex where there's 2 values possible "corp-sur-tmo03" or "corp-tok-tmo03".

Regex :

"corp-*-ips0*" | rex "(?i)^(?:[^\.]*\.){9}\d+\t\d+\t\d+\t\d+\t\d+\t(?P<NIDS>[^\t]+)" | timechart count by NIDS

90% of the values in the column match well but i got 10% matching nothng and is called "NULL" despite of "corp-sur-tmo03" or "corp-tok-tmo03". Strangely, the word "corp-sur-tmo03" and "corp-tok-tmo03" are highlight in the 10% but not reconignize correctly.

Here some screenshot to understand :

The event in NULL aren't in "corp-sur-tmo03" or "corp-tok-tmo03" ?

thanks

Rémi

[bwooden · Accepted solution]

There may be a slight variation in what is in the event and what is being described in the regex. You can validate that by eliminating the 'prefix' and just look for a match on the interesting text:

"corp--ips0" | rex field=_raw "(?corp-(tok|tok)-tmo03)" | timechart count by NIDS

[rbw78]

Thanks for your help it worked 😉

Rémi

[rbw78]

Well it seems i also have an issue with screenshots 😉