About harryhcg

harryhcg · ‎09-06-2023

Single field extraction still wondering why it didn't work.

harryhcg · ‎09-06-2023

Regarding regex suggestion, still have issue. Error - Regex: missing terminating ] for character class. Analysing raw data to use spath. Thank you @gcusello @yuanliu

harryhcg · ‎09-05-2023

Data: {"Field1":"xxx","message1":"{0}","message2":"xxx","message3":{"TEXT":"xxxx: xxx\r\n.xxxxx: {\"xxxxx\":{\"@CDI\":\"@ABC-123G-dhskdd-ghdkshd122@hkfhksdf12-djkshd12-hkdshd12 \",\"@RETURN\":\"xxxx-xxxxxxxxxx-xx-xxxxx\",\"@message4\":\"xxxxxx:xxx\",\"message5\":{\"message6............ Want to extract new field highlighted above but not getting any result. This is what I tried: | rex field=_raw "RETURN\\\"\:\\\"(?<Field2>[^\\]+)"

harryhcg · ‎05-16-2023

Example field value in "Field1" Test1: Successful Test2: 200 Type: Http; Auth: ** URL: abc.com..... IP--Address: xx.xxx.xx.xx Name: xxxxx Path Location: /hdkdsd-/hkk/gdjshd Level: abc User: xxx Site: vjsdjsd Below query not returning any value: index=xxx | rex field=Field1 "Test2\:\s+(?<A1>\d+)\s+" | rex field=Field1 "URL\:\s+(?<A2>\w+)\s+" | rex field=Field1 "User\:\s+(?<A3>\w+)\s+" | table A1, A2, A3

harryhcg · ‎02-03-2023

@ITWhisperer Query performance is not very good but getting result.

harryhcg · ‎02-02-2023

@ITWhisperer Apologies for confusion, let me try to rephrase. Index=abc. FieldA, B, C, D index=bcz. FieldE,F,G I want to return _time, B, C, D, G where value from field E to match with B. I am getting the required output but not able to get G values. This is my query: index=abc fieldA="<>" | rex field=_raw .......FieldB .... FieldC.. Field D | search [ search index=bcz FieldF="<>" | rename FieldE as FieldB | fields FieldB] | stats count as Total by _time, FieldD, FieldC, FieldG | where FieldD="<>"

harryhcg · ‎02-02-2023

I am having 2 index - abc - FieldA, E, F bcz - Field B, C, D. Where I want to return D, C and F where value from field E to match with B. I am getting the required output but not able to get F values. This is my query: index=abc fieldA="<>" | rex field=_raw .......FieldB .... FieldC.. Field D | search [ index=bcz FieldF="<>" | rename FieldE as FieldB | fields FieldB] | stats count as Total by _time, FieldD, FieldC, FieldF | where FieldD="<>"

harryhcg · ‎01-26-2023

@gcusello Thank you for giving time. Can you help to guide why used search twice? Apologies that not shared earlier but I had similar query with search keyword once and was not giving result. index=abc | rex "(?ms)^([^\|]+\|){5}(?<field1>\w+).*\"GET\s+(http|https):\\\\(?<field2>[^\/]+)[^\"]+\"\s+(?<field3>\d+)"| search [ search index=bcz field5="name" | rename field7 AS field1 | fields field1 ]| table field1 field2 field3index=abc | rex "(?ms)^([^\|]+\|){5}(?<field1>\w+).*\"GET\s+(http|https):\\\\(?<field2>[^\/]+)[^\"]+\"\s+(?<field3>\d+)" | search [ search index=bcz field5="name" | rename field7 AS field1 | fields field1 ] | table field1 field2 field3 I am getting the result now but have some issue with count which is not corelating with another query result. Hope not duplicating something. The other query is similar and based on index bcz and bda. For current query output I used index=abc | rex "(?ms)^([^\|]+\|){5}(?<field1>\w+).*\"GET\s+(http|https):\\\\(?<field2>[^\/]+)[^\"]+\"\s+(?<field3>\d+)" | search [ search index=bcz field5="name" | rename field7 AS field1 | fields field1 ] | dedup field1, field3 | stats count by field3 @yuanliuleth field2, 4 and 6 I kept like that and will use on actual result. Trying to fix my errors with expert guidance, get correct logic of my silly mistakes.

harryhcg · ‎01-25-2023

I have 2 index, abc and bcz index abc data is in raw format like below. <random ip address>|-NA\CAPITA|5xxhxh545|jljdjhsdhj78987|hkjhkdjfkjfd5672v2hg7|87675678vf6x_ <random date time> "GET http:\\at-abc.com http/1.1" 500 <random values> I want to pull 87675678vf6x_ as field1 at-abc.com as field2 and 500 as field3. index bcz got formatted data. I now want to compare both indexes with field 1 of index abc with another field7 in bcz where bcz field5="name" and return field1 field2 and field3. It looks simple but not working.

harryhcg · ‎01-24-2023

@ITWhisperer You are awesome, I was so stupid. Thank you.

harryhcg · ‎01-24-2023

Can someone help with query? I have 2 index abc and bcz From abc index I want to show stats for field1 where field2 from index abc matches with field3 of index bcz and bcz index field5="value" what I tried which is not working: index=abc | stats count by field1 | join type=inner field2 [search index=bcz | rename field3 as field2 | where field5="employee_name"]

Posts	14
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎01-24-2023

Online Status	Offline
Date Last Visited	‎09-07-2023 04:31 AM

Rex not yielding result

How to pull multiple fields from one field in Splu...

Why am I unable to output from subsearch?

How to join with rex not working?

Help needed with inner join with different field n...

Re: Rex not yielding result