Hi all,
I am getting an event in the below format:
28/01/2019
07:20:54.000
USERNAME FROM LATEST
Test1 10.0.0.1 Jan 25 15:42:07 2018
admin 10.0.1.31 Jan 15 14:11:26 2019
osadmin 10.0.10.12 Jan 23 16:38:12 2019
awa 10.13.5.21 Oct 1 14:15:16 2018
I am trying to extract USERNAME , FROM ,LATEST as a field using field extraction method. I tried the REGEX for Username like this :
^(?P\w+\s+) , but when I am running the field extraction , it is giving me the Results "USERNAME" only .
Please help me to extract USERNAME,FROM,LATEST from the event via field extraction.
Thanks
Rohit
... View more