Hi, there are four event types , I am gonna share these examples, <134>Nov 24 14:09:52 NSX-edge-7-0 loadbalancer: [default]: 192.168.0.12:53184 [24/Nov/2022:14:09:52.006] CMP_RP_virtualserver CMP_RP_Pool/cmp_rp1_member 1/0/12 3132 -- 4/4/3/3/0 0/0 <28>Nov 24 14:09:00 NSX-edge-7-0 config: [default]: WARN :: C_UTILS :: File /var/db/networkmonitor/monitor_status.dat not exist <30>Nov 24 14:09:00 NSX-edge-7-0 config: [default]: INFO :: loadbalancer stats :: member stats.pool:CMP_RP_Pool,member:cmp_rp2_member,ip:172.xx.xx.x,port:xxx,status:1,vip:CMP_RP_virtualserver <4>Nov 24 14:09:56 NSX-edge-7-0 firewall: [default]: ACCEPT_131091IN= OUT=vNic_0 src=10.2.xx.xx DST=172.xx.xx.xx LEN=62 TOS=0x00 PREC=0x00 TTL=63 ID=31370 DF PROTO=UDP SPT=xx818 DPT=xx LEN=xx As you can see, before [default], there are differents values can be a differentiator. loadbalancer config firewall could I use that for doing rules?
... View more
Hi, if I had logs as such wirn different type data in the same sourcetype: " < 134 > Nov 23 21:23:17 NSX-edge-7-0 loadbalancer [ 2196 ] : [ default ] : 154545" "< 4 > Nov 23 21:06:47 NSX-edge-7-0 firewall  : [ default ] : ACCEPT" How can I extract thew value after "[ default ] : " without extract null values???? For example, if in the first event I created a field called "FIELDA= 154545", i dont want the value in the second event it to be " ACCEPT", I need to create second field called "FIELDB=ACCEPT" I hope to have made me understand Regards,
... View more