How to search based on number



  • Avatar
    Kevin Keech

    There are a few ways you can parse this. (Note: I am assuming you want the name to the left of the epoch timestamp in the message)

    1.) Since the logs are pipe-delimited you can use the "split" operation to parse out the field you need. This assumes the field your looking for is always in the same position in your logs.

    | split _raw delim='|' extract 3 as user

    This operation takes an existing field, in this case the _raw field, which is the message itself, and then uses the delimiter to determine each field of the message. Finally you tell it which field in the message you want to extract, in this case the third field. You can parse other fields using the same operation you just need to include the other locations. Ex. 

    | split _raw delim='|' extract 3 as user, 1 as ip, 6 as event_message

    2.) Using a parse regex expression. This assumes the name is always next to the digit field. 

    | parse regex "\|\s+(?<userb>.*?)\s+\|\s+\d{13}"

    3.) Using a basic parse anchor to parse all the fields from your message. 

    | parse "* | * | * | * | * | * | *" as ip, eventtype, user, timestamp, userb, event_message, someid


    I hope these examples help. 


    Comment actions Permalink
  • Avatar
    Graham Watts

    Hi Kota,

    There are a few options here, parse anchor is probably the easiest assuming these fields are consistently in the order shown in your example log.

    | parse "* | * | * | * | * | * |" as ip,event,user1,id,user2, msg

    Also, here are a few good resources to get you started:

    Thanks and have a good week,



    Comment actions Permalink
  • Avatar
    Kota Shravana

    Thanks Kevin & Graham. Appreciate your quick help

    Comment actions Permalink

Please sign in to leave a comment.