Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

AND | OR Rex field

$
0
0
Hello. I have a few servers: a,b,c and 1,2,3 Servers a,b,c work with this - base search | rex field=cs_uri_stem "(\/apps\/)(?P< test>[\d\w]+)(\/\w+)(.*\b\w+)$" | top limit=1000 test cs_uri_stem= /apps/example/foo.aspx some of the cs_uri_stem will be /apps/example/example/foo.aspx Servers 1,2,3 work with this - base search | rex field=cs_uri_stem "(\/apps\/)|(?P< test>[\d\w]+)(\/\w+)(.*\b\w+)$" | top limit=1000 test cs_uri_stem= /example/foo.aspx I would like to combine them so that I get the results from all the servers. Please excuse the space in < test> it wouldn't show without the space.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>