What is wrong with the way I'm using eval here?
source="/some.audit.log" "End" "/foo/baz"
| rex field=_raw "(?P<ReqId>\bREQ\w{32}\b)"
| rex field=_raw "(?P<IpAddress>\b[\d]{1,3}\.[\d]{1,3}\.[\d]{1,3}\.[\d]{1,3}\b)"
| rex field=_raw "(?i) End \"(?P<Lid>[^\"]*)\""
| rex field=_raw "[^ ] (?P<HostName>\w+\.\w+\.\w+) [^ ]"
| fields ReqId, Lid, HostName, IpAddress
| join ReqId [search
source="/some.error.log" "Fail" "BLOCK"
| rex field=_raw "(?P<ReqId>\bREQ\w{32}\b)"
| rex field=_raw "Status (?P<Status>\b\w*\b)"
| eval raw1=_raw
| fields ReqId, Status, raw1
]
I got this error message
Error in 'eval' command: Failed to parse arguments. eval usage: eval dest_key = expression
... View more