@ITWhisperer Please find the 3 part code-  sourcetype=ib:audit index=ib_audit OBJECT_TYPE=*Network* OBJECT_TYPE!=*Container* ACTION=Created OBJECT_NAME!=10.* AND OBJECT_NAME!=172.16.* AND OBJECT_NAME!=172.17.* AND OBJECT_NAME!=172.18.* AND OBJECT_NAME!=172.19.* AND OBJECT_NAME!=172.20.* AND OBJECT_NAME!=172.21.* AND OBJECT_NAME!=172.22.* AND OBJECT_NAME!=172.23.* AND OBJECT_NAME!=172.24.* AND OBJECT_NAME!=172.25.* AND OBJECT_NAME!=172.26.* AND OBJECT_NAME!=172.27.* AND OBJECT_NAME!=172.28.* AND OBJECT_NAME!=172.29.* AND OBJECT_NAME!=172.30.* AND OBJECT_NAME!=172.31.* AND OBJECT_NAME!=192.168.* (earliest=-1year) | sort -_time | eval MESSAGE=replace(MESSAGE, "\\\\040", " ") | eval MESSAGE=replace(MESSAGE, "\\\\042", "\"") | eval MESSAGE=replace(MESSAGE, "\\\\054", ",") | eval MESSAGE=replace(MESSAGE, "\\\\072", ":") | eval MESSAGE=replace(MESSAGE, "\\\\075", "=") | eval MESSAGE=replace(MESSAGE, "\\\\076", "&amp;gt;") | eval MESSAGE=replace(MESSAGE, "\\\\133", "\[") | eval MESSAGE=replace(MESSAGE, "\\\\134", "\\") | eval MESSAGE=replace(MESSAGE, "\\\\135", "\]") | eval OBJECT_NAME=replace(OBJECT_NAME, "\\\\040", " ") | eval OBJECT_NAME=replace(OBJECT_NAME, "\\\\042", "\"") | eval OBJECT_NAME=replace(OBJECT_NAME, "\\\\054", ",") | eval OBJECT_NAME=replace(OBJECT_NAME, "\\\\072", ":") | eval OBJECT_NAME=replace(OBJECT_NAME, "\\\\075", "=") | eval OBJECT_NAME=replace(OBJECT_NAME, "\\\\076", "&amp;gt;") | eval OBJECT_NAME=replace(OBJECT_NAME, "\\\\133", "\[") | eval OBJECT_NAME=replace(OBJECT_NAME, "\\\\134", "\\") | eval OBJECT_NAME=replace(OBJECT_NAME, "\\\\135", "\]") |rex max_match=0 field=_raw "CITY\",value=\"(?<City>.*?)\s*(\w*+)\]"| eval City = substr(City, 1, len(City)-1) | rex max_match=0 field=_raw "REGION\",value=\"(?<Region>.*?)\s*(\w*+)\]"| eval Region = substr(Region, 1, len(Region)-1)| rex max_match=0 field=_raw "FLOOR\",value=\"(?<Floor>.*?)\s*(\w*+)\]"| eval Floor= substr(Floor, 1, len(Floor)-1)|rex max_match=0 field=_raw "COUNTRY\",value=\"(?<Country>.*?)\s*(\w*+)\]"| eval Country= substr(Country, 1, len(Country)-1)|rex max_match=0 field=_raw "CKT ID\",value=\"(?<CKT_ID>.*?)\s*(\w*+)\]"| eval CKT_ID= substr(CKT_ID, 1, len(CKT_ID)-1)| rex max_match=0 field=_raw "Assignor ID\",value=\"(?<Assignor_ID>.*?)\s*(\w*+)\]"| eval Assignor_ID= substr(Assignor_ID, 1, len(Assignor_ID)-1) |rex max_match=0 field=_raw "IP BLOCK TERMINATION DEVICE\",value=\"(?<IP_Block_Termination_Device>.*?)\s*(\w*+)\]"| eval IP_Block_Termination_Device= substr(IP_Block_Termination_Device, 1, len(IP_Block_Termination_Device)-1)| rex max_match=0 field=_raw "CR NUMBER\",value=\"(?<CR_Number>.*?)\s*(\w*+)\]"| eval CR_Number= substr(CR_Number, 1, len(CR_Number)-1) |rex max_match=0 field=_raw "DEPLOYMENT STATUS\",value=\[\"(?<Deployment_Status>[^\"]*)\"\]"| eval Deployment_Status= substr(Deployment_Status, 1, len(Deployment_Status)-0)| rex max_match=0 field=_raw "Network Location\",value=\"(?<Network_Location>.*?)\s*(\w*+)\]"| eval Network_Location= substr(Network_Location, 1, len(Network_Location)-1) |rex max_match=0 field=_raw "PROJECT NAME\",value=\"(?<Project_Name>.*?)\s*(\w*+)\]"| eval Project_Name= substr(Project_Name, 1, len(Project_Name)-1) |rex max_match=0 field=_raw "FIREWALL HOSTNAME\",value=\"(?<Firewall_Hostname>.*?)\s*(\w*+)\]"| eval Firewall_Hostname= substr(Firewall_Hostname, 1, len(Firewall_Hostname)-1) |rex max_match=0 field=_raw "PROJECT OWNER /SM MAIL ID\",value=\"(?<Project_Owner_SM_Mail_Id>.*?)\s*(\w*+)\]"| eval Project_Owner_SM_Mail_Id= substr(Project_Owner_SM_Mail_Id, 1, len(Project_Owner_SM_Mail_Id)-1)|rex max_match=0 field=_raw "PROJECT/OWNER NAME\",value=\"(?<Project_Owner_Name>.*?)\s*(\w*+)\]"| eval Project_Owner_Name= substr(Project_Owner_Name, 1, len(Project_Owner_Name)-1) |rex max_match=0 field=_raw "REGISTERED UNDER\",value=\"(?<Registered_Under>.*?)\s*(\w*+)\]"| eval Registered_Under= substr(Registered_Under, 1, len(Registered_Under)-1)|rex max_match=0 field=_raw "SR NUMBER\",value=\"(?<SR_Number>.*?)\s*(\w*+)\]"| eval SR_Number= substr(SR_Number, 1, len(SR_Number)-1)|rex max_match=0 field=_raw "SUB CATEGRORY : HOST IP Entity\",value=\"(?<Sub_Categrory_Host_IP_Entity>.*?)\s*(\w*+)\]"| eval Sub_Categrory_Host_IP_Entity= substr(Sub_Categrory_Host_IP_Entity, 1, len(Sub_Categrory_Host_IP_Entity)-1) |rex max_match=0 field=_raw "BUILDING\",value=\[\"(?<Building>[^\"]*)\"\]"| eval Building= substr(Building, 1, len(Building)+1)| rex max_match=0 field=_raw "FIREWALL MANAGEMENT IP\",value=\"(?<Firewall_Management_IP>.*?)\s*(\w*+)\]"| eval Firewall_Management_IP= substr(Firewall_Management_IP, 1, len(Firewall_Management_IP)-1)|rex max_match=0 field=_raw "VLAN-ID\",value=\"(?<Vlan_ID>.*?)\s*(\w*+)\]"| eval Vlan_ID= substr(Vlan_ID, 1, len(Vlan_ID)-1) |rex max_match=0 field=_raw "VLAN-Name\",value=\"(?<Vlan_Name>.*?)\s*(\w*+)\]"| eval Vlan_Name= substr(Vlan_Name, 1, len(Vlan_Name)-1) |rex max_match=0 field=_raw "TERMINATION TECHNICAL CONTACT\",value=\"(?<Termination_Technical_Contact>.*?)\s*(\w*+)\]"| eval Termination_Technical_Contact= substr(Termination_Technical_Contact, 1, len(Termination_Technical_Contact)-1) |rex max_match=0 field=_raw "SUBNET TYPE\",value=\"(?<Subnet_Type>.*?)\s*(\w*+)\]"| eval Subnet_Type= substr(Subnet_Type, 1, len(Subnet_Type)-1) |rex max_match=0 field=_raw "OWNER OF SUBNET\",value=\"(?<Owner_Of_Subnet>.*?)\s*(\w*+)\]"| eval Owner_Of_Subnet= substr(Owner_Of_Subnet, 1, len(Owner_Of_Subnet)-1) |rex max_match=0 field=_raw "Network Comment\",value=\"(?<Network_Comment>.*?)\s*(\w*+)\]"| eval Network_Comment= substr(Network_Comment, 1, len(Network_Comment)-1) |rex max_match=0 field=_raw "GATEWAY 2 MANAGEMENT IP\",value=\"(?<Gateway_2_Management_IP>.*?)\s*(\w*+)\]"| eval Gateway_2_Management_IP= substr(Gateway_2_Management_IP, 1, len(Gateway_2_Management_IP)-1) |rex max_match=0 field=_raw "GATEWAY MANAGED BY\",value=\"(?<Gateway_Managed_By>.*?)\s*(\w*+)\]"| eval Gateway_Managed_By= substr(Gateway_Managed_By, 1, len(Gateway_Managed_By)-1)|rex max_match=0 field=_raw "GATEWAY TECHNICAL CONTACT\",value=\"(?<Gateway_Technical_Contact>.*?)\s*(\w*+)\]"| eval Gateway_Technical_Contact= substr(Gateway_Technical_Contact, 1, len(Gateway_Technical_Contact)-1)|rex max_match=0 field=_raw "GATEWAY1 MANAGEMENT IP\",value=\"(?<Gateway1_Management_IP>.*?)\s*(\w*+)\]"| eval Gateway1_Management_IP= substr(Gateway1_Management_IP, 1, len(Gateway1_Management_IP)-1) |rex max_match=0 field=_raw "HOST NAME GATEWAY1\",value=\"(?<Host_Name_Gateway1>.*?)\s*(\w*+)\]"| eval Host_Name_Gateway1= substr(Host_Name_Gateway1, 1, len(Host_Name_Gateway1)-1) |rex max_match=0 field=_raw "HOST NAME GATEWAY2\",value=\"(?<Host_Name_Gateway2>.*?)\s*(\w*+)\]"| eval Host_Name_Gateway2= substr(Host_Name_Gateway2, 1, len(Host_Name_Gateway2)-1) |rex max_match=0 field=_raw "HOST TYPE\",value=\"(?<Host_Type>.*?)\s*(\w*+)\]"| eval Host_Type= substr(Host_Type, 1, len(Host_Type)-1) |rex max_match=0 field=_raw "IP BLOCK TYPE\",value=\"(?<IP_Block_Type>.*?)\s*(\w*+)\]"| eval IP_Block_Type= substr(IP_Block_Type, 1, len(IP_Block_Type)-1) |rex max_match=0 field=_raw "ODC\",value=\"(?<ODC>.*?)\s*(\w*+)\]"| eval ODC= substr(ODC, 1, len(ODC)-1)|rename TIMESTAMP as "Timestamp", ADMIN as "Admin", ACTION as "Action", OBJECT_TYPE as "Network Type", OBJECT_NAME as "Network", EXEC_STATUS as "Execution Status", MESSAGE as "Message", host as "Member" | table "Timestamp" "Admin" "Network Type" "Network" "City" "IP_Block_Type" "Region" "Country" "Network_Location" "Building" "ODC"  "Floor"  "Project_Name" "CKT_ID" "Assignor_ID" "IP_Block_Termination_Device" "CR_Number" "Deployment_Status" "Firewall_Hostname" "Project_Owner_SM_Mail_Id" "Project_Owner_Name" "Registered_Under" "SR_Number" "Firewall_Management_IP" "Vlan_ID" "Vlan_Name" "Termination_Technical_Contact" "Subnet_Type" "Owner_Of_Subnet" "Network_Comment" "Gateway_2_Management_IP" "Gateway_Managed_By" "Gateway_Technical_Contact" "Gateway1_Management_IP" "Host_Name_Gateway1" "Host_Name_Gateway2" "Host_Type"  "Sub_Categrory_Host_IP_Entity"  ... View more

Hi @ITWhisperer, the First snip shows the audit logs and I've highlighted the IP Block Type details in the Snip. Audit logs  The second snip showing an output printed for IP_Block_Type but it containing all the details descendant action etc that I don't want to print any value for that entries. That should be omitted. Snip2   The third Snip is showing the logic that I have used to get the details from the audit logs of IPAM. Logic to fetch the data ... View more

In a result, it is showing an "OVERRIDE"  but it is taking operation="OVERRIDE"  from 2nd condition also and I don't want that. I just want to print 1 condition with operation="OVERRIDE"  ... View more

@to4kawa I just want to get case number 1, not 3. 3rd case has many other details including operation="OVERRIDE" so don't want this case to be check while using  rex field=_raw "operation=\"(?<IP_Block_Type>.\w+)\"" | where isnotnull(IP_Block_Type)   ... View more

@ITWhisperer It is not working. I dont want [name="IP BLOCK TYPE",value="Public",descendants_action={option_with_ea:"INHERIT",option_without_ea:"NOT_INHERIT"},operation="OVERRIDE"]  to be printed as this has operation="OVERRIDE".  so help me to discard this case while checking 1 and 2. 1st should print not second one. ... View more

@to4kawa Nope.. it is not working ... View more

Thanks a lot @ITWhisperer  ... View more

@gcusello the log message is looks like  [name="IP BLOCK TYPE",value="Private",operation="OVERRIDE"]. I just wanted to fetch operation="OVERRIDE" through the regex. ... View more

not working  ... View more

Thanks, @ITWhisperer  ... View more

I tried below command |rex max_match=0 field=_raw "BUILDING\",value=\"(?<Building>.*?)\s*(\w*+)\]"| eval Building= substr(Building, 1, len(Building)-1)| ... View more