This might mess up the order of the mainKey and the corresponding extracted subKey values, but it's ok in my case. When there are multiple extracting stanzas matching one or more values in mainKey, the first one extracts its (potentially multitude of) values, then all those extracted by the second one are added, and so on. $ matches both the end of the whole set of multiple values (which seems to be treated internally as multi-line) and the ends of each individual value with or without that flag, as evidenced by my first stanza. * would consume all the subsequent mainKey values. I needed that (?m-s) at the beginning of the second REGEX because otherwise the. For example, I also added the following extraction, which, when found a mainKey value starting with "!" (exclamation sign), strips it and saves the rest as a subKey (just to serve as an example): Īnd referenced both from this nf property: REPORT-subKey = subKey, subKey1. Moreover, I found that if I need more than one subKey extraction (for example, if there are different formats of mainKey requiring different results), I can add another stanza and reference it from nf - even in the same REPORT property. The nf stanza for creating that subKey now looks like this: įORMAT is commented out because I have a named field extraction in the REGEX itself, but it's there as a reminder. Update: I found the right way after realizing the error in my testing. and still get the same results, thanks to the props and transforms performing that extraction for me. My objective would be to remove that | rex. I check the functionality by adding | table mainKey, subKey to that search string and looking at the results. You can specify one of the following modes for the foreach command: Argument. If a mode is not specified, the foreach command defaults to the mode for multiple fields, which is the multifield mode. The documentation is extremely vague on, for example, SOURCE_KEY value, but I did try both SOURCE_KEY=mainKey and SOURCE_KEY=field:mainKey with no success. Description: Tells the foreach command to iterate over multiple fields, a multivalue field, or a JSON array. Is there any good way to mimic that search time extraction in nf/ nf? So far I tried some REPORTS to no avail. Here is the search string, that I'm using right now: index = "testIndexTimeFields" sourcetype = "testIndexFields" | rex field=mainKey "^*(?P\d )$"Īnd it does exactly what I expect: for those events where mainKey is multivalue, the corresponding values of subKey are extracted from each individual mainKey wherever possible, creating multivalue subKey when there is more than one parseable mainKey value. I already have a multivalue mainKey, but want to extract a subKey from it, and do it not on search line, if possible, but in the props/transforms. In there, I managed to extract a multivalue index-time field, but could not use that one to extract another one from it. ![]() This is a follow-up to my previous question.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |