|
If my rex field has one or multiple fields delimited by commas, how can I get the last value if there is more than one? Or if there is only one value, then retrieve that one. Search: sourcetype="xxxxxx" | rex field=_raw "True IP:(?<true_ip>.*)" True IP:68.5.194.110, 204.2.160.228 True IP:81.21.89.165 |
|
Thank you Kristian, you did give me the idea to resolve the issue correctly. It appears that what I needed was the first IP address and not the last. I discovered erex and what a powerful tool! It generated the following rex that solved my problem: |
|
If you are not interested in the first of two TrueIP's, you could always do something like this for a log message that looks like: the field extraction would be something like: hope this helps, but please provide more info in order to get better help /k |
