Greetings,
Please help!!
I need to extract the ID value from the two events below, and I’m kinda banging my head here… . I just need to list Q123456789 and each ID in my dashboard. But it I can’t...
See more...
Greetings,
Please help!!
I need to extract the ID value from the two events below, and I’m kinda banging my head here… . I just need to list Q123456789 and each ID in my dashboard. But it I can’t get past all of the special characters.
I’ve tried using different combinations like this:
| eval msg=”the event”
| rex "msg =(?< policyId >\w+)”
| table policyId
But what I would really like to have something like this in my dashboard:
Starting Controller Q123456789
CallStatus=Success Q123456789
Starting Controller Q123456788
CallStatus=Success Q123456788
Starting Controller Q123456787
CallStatus=Success Q123456787
And so on.
Is this possible?
Your help is always appreciated.
Thanks
Starting Controller=Fall Action=GetFallReportAssessment data={"policyId":"Q123456789","inceptionDate":"20250501","postDate":"1900-01-01T12:00:00"}
API=/api/Fall/reportAssessment/ CallStatus=Success Controller=Fall Action=GetFallReportAssessment Duration=27 data={"policyId":"Q123456789","inceptionDate":"20250501","postDate":"1900-01-01T12:00:00"}