Hi, I have mail server logs where each mail has the MID number as identifier (for that mailserver =host, for that day) MID 1234567 From: someone1@domain.do MID 1234567 To: someone3@gmail.com MID 1234567 Subject: ... MID 1234567 .... I'm trying to find the To with the subsearch and extract the host and MID values. For using MID only it working perfectly, however it is not fail safe (it might happen that more than one mail server might have the exact same MID on the same day) index="mail" "MID" [search index="mail" "MID" ("someone1@domain.do" OR "someone2@othdomain.nu")|rex "MID (?<MID>\d+)"|dedup MID|fields + MID|rename MID as query] This works perfectly. Now I wanted to add the host variable for get string pairs to search for. Important that I want the result as string without variable names: This is what I've tried: index="mail" "MID" [search index="mail" "MID" ("someone1@domain.do" OR "someone2@othdomain.nu")|rex "MID (?<MID>\d+)"|dedup host MID|fields host MID|format "(" "(" "AND" ")" "OR" ")"|rename output as query] EDIT/REMARK: I've tried to combine the "host" and "MID" variables into "output" in some way, but it just did not work. that is the reason for this non-functioning rename at the end.. However seems the variable names are there. Could you please help how to remove both variable names or at least for the "MID" ? (Interested in both solution, but any good solution is perefectly fine) EDIT1: Checking the inner search result, because the whole search just not working due to this problem. EDIT2: Have tried to parse the whole output line to variable then replace with either "rex mode=sed" or with "replace" in two way, however seems I can't get the formatted output to variable anymore. (this is the inner query only) index="mail" "MID" [search index="mail" "MID" ("someone1@domain.do" OR "someone2@othdomain.nu")|rex "MID (?<MID>\d+)"|dedup host MID|fields host MID|format "(" "(" "AND" ")" "OR" ")"|rex "^(?<output>.*$)"|eval output=replace(output,"MID=","") |rename output as query
... View more
