XQL use to or operator in the Regextract

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

XQL use to or operator in the Regextract

L0 Member

Hi

I want to use or operator in XQL regextraxt but the following command does not work. Can you help us.
Thank you.

|alter etki=regextract(message ,"Etki\sAlanı\sAdı\:\s+([^\n\r]+) | Domain\sName\:\s+([^\n\r]+)")

 

 

2 REPLIES 2

L5 Sessionator

Hi @AtilaTasli, thanks for reaching us using the Live Community.

 

Please remove the whitespaces at each side of the "|" character and try again.

 

If this post answers your question, please mark it as the solution.

JM

Hi Jmazzeo,

Thank you for your response. But  When I do as you specified in XQL, I get "
Could not be executed because your query is invalid." error.

 

My XQL query 

dataset =microsoft_windows_raw
|alter etki=regextract(message ,"Etki\sAlanı\sAdı\:\s+([^\n\r]+)|Domain\sName\:\s+([^\n\r]+)")

 

In our event logs, we will use the logs we receive from Turkish and English operating systems in correlations. This "OR" operator will make our job really easy.
I can get the result I need with the query below, but I need to write a lot of code.

dataset =microsoft_windows_raw

|change domain1=arrayindex(regextract(message , "Domain\sArea\sName\:\s+([^\n\r]+)"),0 )
|change domain2=arrayindex(regextract(message , "Domain\sName\:\s+([^\n\r]+)"),0)

|alter final_domain_name=
if (domain1!= "",
domain1,
domain2 )

|limit 100
|fields final_domain_name ,*

  • 641 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!