That is what I meant with "no matter the capture groups within a bracket". As mentioned (I might be wrong but that is how I recall) if it is something you are personally adding as a custom property and not a common property for all the logs (like Event ID, Category, Source IP, Source MAC, Username etc.) I do not think you can use the Format string and combine them; you can create multiple capture groups in your statement and select one of those from which you want to pull the content... And this is within the DSM editor as it is when you use the Extract property option from the log record - you can't put multiple capture group numbers there in the Capture group field.
Original Message:
Sent: Fri March 15, 2024 06:58 AM
From: Arunkumar R
Subject: Combine Two Strings
Hi Dusan,
If I give '0' it fetches all the strings without ignoring as I defined in the regex.
------------------------------
Arunkumar R
Original Message:
Sent: Wed March 13, 2024 07:40 AM
From: Dusan VIDOVIC
Subject: Combine Two Strings
The last example Comghall provided is for the Log Source Time - which is a mandatory field. Using combination of Format strings when creating parsing for mandatory fields (properties) you can concatenate the needed strings. Now, you are creating a "personal" custom property, where capture groups are used, and I am not sure that concatenation in the same way as for mandatory fields is possible. However, if you use "0" (instead of entering/selecting capture group numbers), the content that matches the regex statement you put (no matter the capture groups within a bracket) would be pulled into your custom property field (at least it was like this in my lab).
------------------------------
Dusan VIDOVIC
Original Message:
Sent: Wed March 13, 2024 01:13 AM
From: Arunkumar R
Subject: Combine Two Strings
Hi Morgan,
Thank you for your response.
I hope you read and seen my previous post snapshots. In my case, it is shown as Capture Group, not the Format String.
The concatenation works as stated in the provided link for the Format string only, but not for the Capture Group.
The Format string is available only in the default property, If I use the default property I can't rename it.
I am not sure why QRadar side did not update this point.
Thanks
------------------------------
Arunkumar R
Original Message:
Sent: Tue March 12, 2024 11:14 AM
From: Comghall Morgan
Subject: Combine Two Strings
Hello Arunkumar,
Apologies for delay.
I found another technote that goes through a similar matching sequence.
https://www.ibm.com/support/pages/qradar-how-change-or-customize-log-source-time
If you look at section 3, this documents how they are combining the 2 capture groups into one.
Regards,
------------------------------
Comghall Morgan
QRadar Support Architect
IBM
Original Message:
Sent: Sun March 10, 2024 01:30 AM
From: Arunkumar R
Subject: Combine Two Strings
Hi Morgan,
It doesn't work, see the snapshots below. Format string only accepting the $. If you can please share the snapshot.
I tried individually as well as combined.
My QRadar Version is 7.5.0 UP6
Thanks
------------------------------
Arunkumar R
Original Message:
Sent: Fri March 08, 2024 10:13 AM
From: Comghall Morgan
Subject: Combine Two Strings
Hello,
Yes where you have Capture Group can use the values $1.$2.
What you hvae entered is just the number 1. This will not work.
It needs to be $1
Regards
------------------------------
Comghall Morgan
QRadar Support Architect
IBM
Original Message:
Sent: Thu March 07, 2024 01:59 AM
From: Arunkumar R
Subject: Combine Two Strings
Hi,
I tried to combine two URL strings as one using Regex, but it is not reflecting.
As per the link below, I was unable to locate the format string field in the DSM editor.
Referencing capture strings by using format string fields - IBM Documentation
part of Log:
"ClientRequestHost":"xxxxx.yyyyy.com","ClientRequestMethod":"GET","ClientRequestURI":"/mobile/js/common.js"
There is only capture group, no format string.
I have tried two different expression as well in the same property.
Experts, please assist me to complete it.
Thanks
------------------------------
Arunkumar R
------------------------------