I have tried the above search but it is not working.
from the access.log, by running the below search i will get the 3 lines which is mentioned in my previous post.
index=gf_ldap host=uklvadede03a source=*access.log "connection from" OR OVD-20038 OR OVD-20039 |transaction conn
from this search when i tried to add your search query, i am not getting the exact output which i need as per below format.
exact query used
index=gf_ldap host=uklvadede03a source=*access.log "connection from" OR OVD-20038 OR OVD-20039 |transaction conn |extract pairdelim=" " kvdelim="=" | rex "from\s(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})" | rex "dn=(?[^\s]+)" | eval result=case(err=0,"Success", err=null, "Success", 1=2, "Fail") | eval conn=replace(conn, ",", "") | streamstats latest(ip) as ip latest(dn) as dn latest(result) as result by conn
Output format
timelime, IP, dn, Result
Sample
2015-12-30T09:01:00.429, 10.193.30.202,Success
... View more
