When I use | eval msgTxt= I get no results, but if I use | eval _raw it returns the requested data, but it repeats the same values. index="cif" appEnvrnNam="Production" msgTxt="StandardizedAddres...
See more...
When I use | eval msgTxt= I get no results, but if I use | eval _raw it returns the requested data, but it repeats the same values. index="cif" appEnvrnNam="Production" msgTxt="StandardizedAddressService SUCCEEDED*" | eval msgTxt="StandardizedAddressService SUCCEEDED - FROM: {\"StandardizedAddressService\":\"SUCCEEDED\",\"FROM\":{\"Address1\":\"123 NAANNA SAND RD\",\"Address2\":\"\",\"City\":\"GREEN\",\"County\":null,\"State\":\"WY\",\"ZipCode\":\"44444-9360\",\"Latitude\":null,\"Longitude\":null,\"IsStandardized\":false,\"AddressStandardizationStatus\":1,\"AddressStandardizationType\":1},\"RESULT\":1,\"AddressDetails\":[{\"AssociatedName\":\"\",\"HouseNumber\":\"123\",\"Predirection\":\"\",\"StreetName\":\"NAANNA SAND RD\",\"Suffix\":\"RD\",\"Postdirection\":\"\",\"SuiteName\":\"\",\"SuiteRange\":\"\",\"City\":\"GREEN\",\"CityAbbreviation\":\"GREEN\",\"State\":\"WY\",\"ZipCode\":\"44444\",\"Zip4\":\"9360\",\"County\":\"Warren\",\"CountyFips\":\"27\",\"CoastalCounty\":0,\"Latitude\":77.0999,\"Longitude\":-99.999,\"Fulladdress1\":\"123 NAANNA SAND RD\",\"Fulladdress2\":\"\",\"HighRiseDefault\":false}],\"WarningMessages\":[],\"ErrorMessages\":[],\"GeoErrorMessages\":[],\"Succeeded\":true,\"ErrorMessage\":null}" | rex "\"Latitude\"\s*:\s*(?<Latitude>-?\d+\.\d+)" | rex "\"Longitude\"\s*:\s*(?<Longitude>-?\d+\.\d+)" | rex "\"WarningMessages\"\s*:\s*\[\s*\"(?<WarningMessages>[^\"]*)" | table _time Latitude Longitude WarningMessages