Hello,
I'm having an issue with a regex i did.
I want to create a new column with my regex where there's 2 values possible "corp-sur-tmo03" or "corp-tok-tmo03".
Regex :
"corp-*-ips0*" | rex "(?i)^(?:[^\.]*\.){9}\d+\t\d+\t\d+\t\d+\t\d+\t(?P<NIDS>[^\t]+)" | timechart count by NIDS
90% of the values in the column match well but i got 10% matching nothng and is called "NULL" despite of "corp-sur-tmo03" or "corp-tok-tmo03". Strangely, the word "corp-sur-tmo03" and "corp-tok-tmo03" are highlight in the 10% but not reconignize correctly.
Here some screenshot to understand :
The event in NULL aren't in "corp-sur-tmo03" or "corp-tok-tmo03" ?
thanks
Rémi
There may be a slight variation in what is in the event and what is being described in the regex. You can validate that by eliminating the 'prefix' and just look for a match on the interesting text:
"corp--ips0" | rex field=_raw "(?
There may be a slight variation in what is in the event and what is being described in the regex. You can validate that by eliminating the 'prefix' and just look for a match on the interesting text:
"corp--ips0" | rex field=_raw "(?
Thanks for your help it worked 😉
Rémi
Well it seems i also have an issue with screenshots 😉