Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Transforming Field Value with Rex/Regex?

$
0
0
Hey! So I have this field: "user1 user2 user3 user4 user5 user6 (.....)" and I wanted it to look like "(account="user1" OR account="user2" OR account="user3" OR (.....))" without using format or append/join, but using regex/rex. Any ideas on this? PS1: the value isn't actually user*, it is a combination of letters and numbers, like uiw849tghuADIIJO34ow. Thanks in advance!!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>