Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- sourcetype=stream:http
- | rex field=dest_content "\"email\":\"(?<user_id>.+)\"\,\"group"
- | rex field=dest_content "\"grand_total\":\"(?<sum>.+)\",\"base_grand"
- | table user_id sum
- | search user_id=*
- | search sum>1000
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
