I'm trying to remove characters after a certain string in my search string. I am still getting the strings after "3" appearing after. I only want a 3 to be displayed.
I only want the 3 to show up from "number of supervisor reminder memos sent:" and I want everything after the 3 to removed.
Here's my search string:
index=monitoring sourcetype=PEGA:WinEventLog:Application ( SourceName="RoboticLogging" OR SourceName="Application" ) ("Department=" "HRSS_NEO") ("Type=" "Information") | rex "Number of supervisor reminder memos sent: (?.+.?)"| stats by ex
Here's my results
10/31/2019 10:58:04 AM
LogName=Application
SourceName=RoboticLogging
EventCode=0
EventType=4
Type=Information
ComputerName=WTWFBVZP.UNITOPR.UNITINT.TEST.STATEFARM.ORG
TaskCategory=%1
OpCode=Info
RecordNumber=50913
Keywords=Classic
Message=
↧
