Hi all i need to do a search like this:
sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security" | rename Source_Network_Address as IP | rename IP_Source as IP
where the IP is in a field of another search. How can i do this?
If the IP could possibly be in several locations, and you want to normalize them into a field, I like the coalesce command in eval.
sourcetype="webseal_access" OR sourcetype="wmi:wineventlog:security" | eval IP = coalesce(Source_Network_Address,IP_Source)
This says "make a new field called IP, and use the value from the first non-empty field."
Take a look at the format command: