sourcetype names are xml and raw_text. That's why I mentioned that you need to adjust as I did not know your sourcetype names. For this particular purpose, you can simply tweak sourcetype name t...
See more...
sourcetype names are xml and raw_text. That's why I mentioned that you need to adjust as I did not know your sourcetype names. For this particular purpose, you can simply tweak sourcetype name to represent CopyLocation and TargetLocation - or any other name you want to use in foreach. | eval sourcetype = if(sourcetype == "raw_text", "CopyLocation", "TargetLocation") (Without mucking sourcetype value, you can also use "foreach raw_text xml" and get the correct results, then rename the fields.) Here is a complete emulation | makeresults
| eval sourcetype = "raw_text", data = mvappend("2024-12-18 17:02:50, file_name=\"XYZ.csv\", file copy success",
"2024-12-18 17:02:58, file_name=\"ABC.zip\", file copy success",
"2024-12-18 17:03:38, file_name=\"123.docx\", file copy success",
"2024-12-18 18:06:19, file_name=\"143.docx\", file copy success")
| mvexpand data
| eval _time = strptime(replace(data, ",.+", ""), "%F %T")
| rename data AS _raw
| extract
| append
[makeresults
| eval sourcetype = xml, _raw = "2024-12-18 17:30:10 <FileTransfer status=\"success\">
<FileName>XYZ.csv</FileName>
<FileName>ABC.zip</FileName>
<FileName>123.docx</FileName>
</FileTransfer>"
| eval _time = strptime(replace(_raw, "<.+", ""), "%F %T")]
``` the above emulates
sourcetype IN (CopLocation, TargetLocation)
```
| eval sourcetype = if(sourcetype == "raw_text", "CopyLocation", "TargetLocation")
| eval target_log = replace(_raw, "^[^<]+", "")
| spath input=target_log
| mvexpand FileTransfer.FileName
| eval FileName = coalesce(file_name, 'FileTransfer.FileName')
| chart values(_time) over FileName by sourcetype
| sort CopyLocation
| foreach *Location
[eval <<FIELD>> = strftime(<<FIELD>>, "%F %T")]
| fillnull TargetLocation value=Pending