Parsing delimited logs that are not constant in length?


1 comment

  • Avatar
    Kevin Keech

    Hi Luis,

    I would look at using a parse regex along with the "multi" flag for this use case. Using your example, this would look something like the following.


    | parse regex "MACHINE_NAME: (?<machine_name>.*), DRIVES: (?<drive_list>.*)"
    | parse regex field=drive_list "(?<drive>.*?) - (?<permissions>.*?)(?:,|$)" multi
    | count by machine_name, drive, permissions


    The first parsing will get the machine name and list of drives from the message. The second parsing then parses the drive list field and creates additional lines for each drive/permission pair in the list.  You can then use an aggregate function (count in the above) to display the different machine/drive/permission combos. 

    I hope this might help with your use case. 



    Comment actions Permalink

Please sign in to leave a comment.