hi i would like some help on how to extract the next 5 lines after a keyword where it extracts the full line where the keyword is part of.
example below....
where the keyword is the 'ethernet'
**********************************************
Redundant-ethernet Information:
Name Status Redundancy-group
reth0 Down Not configured
reth1 Up 1
reth2 Up 1
reth3 Up 1
reth4 Down Not configured
reth5 Down Not configured
reth6 Down Not configured
reth7 Down Not configured
reth8 Down Not configured
reth9 Up 2
Redundant-pseudo-interface Information:
Name Status Redundancy-group
lo0 Up 0
*****************************************
example value of a field now would be..
Redundant-ethernet Information:
Name Status Redundancy-group
reth0 Down Not configured
reth1 Up 1
reth2 Up 1
reth3 Up 1
thanks, if it can be generic enough enough so that i can use it for other rex searches that of similar data
Hi @thaghost99,
please try this regex:
(?<my_field>.*ethernet[^\n]+(\n.*){5})
that you can test at https://regex101.com/r/6MlmNV/1
Ciao.
Giuseppe
Hi @thaghost99,
please try this regex:
(?<my_field>.*ethernet[^\n]+(\n.*){5})
that you can test at https://regex101.com/r/6MlmNV/1
Ciao.
Giuseppe
oh man. you are super fast @gcusello,
and it works just how i want it to.. 🙂 you are amazing. thank you very very much.
Hi @thaghost99,
good for you, see next time!
let me know if I can help you more, or, please, accept one answer for the other people of Community.
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
thank you @gcusello solution accepted.
side question or easy one. i was googling how to increase the width of an input field, but i see mostly html, but i only have <form> on mine
how can i change the width of the below input?
<input type="multiselect" token="field1" searchWhenChanged="true">
<label>Select Hostname</label>
<fieldForLabel>Hostname</fieldForLabel>
<fieldForValue>Hostname</fieldForValue>
<search>
<query>index = 1234 </query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<delimiter> OR </delimiter>
</input>
Hi @thaghost99,
for a new question is always better to open a new case, so more people can help you.
In this case, the only way is to modify the CSS, but I cannot help you in this.
Ciao.
Giuseppe