Hi,
Does anyone know what i need to put in between these two fields in order to make the query continue on the ip2 if ip1 is found on a single log event? Sometimes there may not be an ip2... \s+ is what i have currently.
| rex "(?i)(?<ip1>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+(?<ip2>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
... View more