About Aks_PC_20

Aks_PC_20 · ‎04-28-2022

The value of value2 field is dynamic , each event will have different value. First query you mentioned worked but only thing is it consider the value only upto the end of line but does not consider the value which is continued in next line

Aks_PC_20 · ‎04-28-2022

This works but if the value is displayed as value="data need to be displayed here " here the value will be displayed only up to "data need to be " and not the complete string which is in next line.

Aks_PC_20 · ‎04-27-2022

In a log if there are two similar words with different value , how to retrieve value of second word using regex ? Example: "Display details of value =abc and value=def for id=1". how to display value "def" ? index=* "Letters" |rex field=_raw max_match=0 "value=?(?<value2>[^\n]*)" |stats values(value2) as letter by id Above query returns 1 "abc and value=def"

Posts	3
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎04-27-2022

Online Status	Offline
Date Last Visited	‎05-02-2022 03:16 PM

How retrieve value of second matching word?

Re: Retrieve value of second matching word

Re: Retrieve value of second matching word

How retrieve value of second matching word?