Hi, Please help me in extracting multivalue fields from email body logs: LOG: "Computer Name","Patch List Name","Compliance Status","Patch List Name1","Compliance Status1","OS Type1" "XXXX.e...
See more...
Hi, Please help me in extracting multivalue fields from email body logs: LOG: "Computer Name","Patch List Name","Compliance Status","Patch List Name1","Compliance Status1","OS Type1" "XXXX.emea.intra","ACN - Windows Server - PL - Up to Oct24","Compliant","[ACN - Windows Server - PL - Up to Aug24] + [ACN - Windows Server - PL - Sep24]","Compliant","Windows" "XXXX.na.intra","ACN - Windows Server - PL - Up to Oct24","Compliant","[ACN - Windows Server - PL - Up to Aug24] + [ACN - Windows Server - PL - Sep24]","Compliant","Windows" Fields i want to extract are these: "Computer Name","Patch List Name","Compliance Status","Patch List Name1","Compliance Status1","OS Type1" I have applied rex to bring out all the fields The rex is giving me total number of 3131 computer_names but when i am using mvexpand command to expand in into multiple rows , it is giving me only 1500 results not sure why rest are getting truncated. Attaching the search query and snippet for reference:
index=mail "*tanium*"
|spath=body
|rex field=body max_match=0 "\"(?<Computer_name>.*)\",\"ACN"
|rex field=body max_match=0 "\"(?<Computer_name1>.*)\",\"\[n"
|rex field=Computer_name1 max_match=0 "(?<Computer_name2>.*)\",\"\[n"
|eval Computer_name=mvappend(Computer_name,Computer_name2)|table Computer_name
|dedup Computer_name
| mvexpand Computer_name
| makemv Computer_name delim=","
index=mail "*tanium*"
|spath=body
|rex field=body max_match=0 "\"(?<Computer_name>.*)\",\"ACN"
|rex field=body max_match=0 "\"(?<Computer_name1>.*)\",\"\[n"
|rex field=Computer_name1 max_match=0 "(?<Computer_name2>.*)\",\"\[n"
|eval Computer_name=mvappend(Computer_name,Computer_name2)
|rex field=body max_match=0 "\,(?<Patch_List_Name1>.*)\"\["
|rex field=Patch_List_Name1 max_match=0 "\"(?<Patch_List_Name>.*)\",\""
|rex field=Patch_List_Name1 max_match=0 "\",\""(?<Compliance_status>.*)\"
|table Computer_name Patch_List_Name Compliance_status
|dedup Computer_name Patch_List_Name Compliance_status
| eval tagged=mvzip(Computer_name,Patch_List_Name)
| eval tagged=mvzip(tagged,Compliance_status)
| mvexpand tagged
| makemv tagged delim=","
| eval Computer_name=mvindex(tagged,0)
| eval Patch_List_Name=mvindex(tagged,1)
|eval Compliance_status=mvindex(tagged,-1)
|table Computer_name Patch_List_Name Compliance_status