I've a sub search on an SMTP log to get all TO and FROM values together with the status. Unfortunately TO and FROM are in one log entry and TO and STATUS in a different one. Common field is the TextID. Simplified the log structure looks like the following for a single TextID: ...
{"id":null,"log":{"text":"123A: to=<T@>, status=sent"}}
{"id":null,"log":{"text":"123A: to=<T@>, status=deferred"}}
{"id":null,"log":{"text":"123A: from=<F@> to=<T@> proto=ESMTP"}}
... My current search: index=A
[ search index=A "to=<"
| rex field=log.text "(?<TextID>\w+).*from=<(?<FROM>.*)> to=<(?<TO>.*)> "
| dedup TextID
| return 1000000 $TextID
]
| rex field=log.text "(?<TextID>\w+).*to=<(?<TO>.*)>.*, status=(?<STATUS>.*\))"
| table TextID TO STATUS My current result: TextID TO STATUS 123A To1 sent 123A To1 deferred 234B To2 sent 234B To2 delayed 345C To3 sent How can I also print out the FROM which is only available in the sub search in the result set of the main search? I already tried to resolve this with union, join, append, appendcols but was unable to get expected result. Expected result would be: TextID TO STATUS FROM 123A To1 sent From1 123A To1 deferred From1 234B To2 sent From2 234B To2 delayed From2 345C To3 sent From1 Thank you Jörg
... View more
