getting value as Null

[sharmas2]

I am getting Null value in IPReputationSICategory field ..

PFB raw logs:-

DstIP=194.20.78.49, SrcPort=40227, DstPort=3257, Protocol=tcp, IngressInterface=DPB1-IN, EgressInterface=DPB1-OUT, IngressZone=CITADEL-Milan-DPB1, EgressZone=CITADEL-Milan-DPB1, ACPolicy=NGSS2-Milan, Prefilter Policy=NGSS2-Milan-Prefilter, InitiatorPackets=1, ResponderPackets=0, InitiatorBytes=58, ResponderBytes=0, SecIntMatchingIP=Source, IPReputationSICategory=Custom-Blocklist-Global-IP_FS, ClientAppDetector=AppID, HostName=IT1IPS03P4N1-1_2
Show less..

fetch logs // scanLimitGBytes: , samplingRatio: 1000
| filter contains(dt.security_context, "ngss")

| parse content,"LD 'IPReputationSICategory: '[0-9a-zA-Z-]{1,100}?:IPReputationSICategory','"
| summarize count(),by :{IPReputationSICategory,index}

for output please refer the attachment ..

[cchanka · Accepted solution]

Below DQL might work

fetch logs // scanLimitGBytes: , samplingRatio: 1000
| filter contains(dt.security_context, "ngss")
| parse content,"LD 'IPReputationSICategory=' LD:IPReputationSICategory ','"
| summarize count(),by :{IPReputationSICategory,index}

[marco_irmer]

Your log sample shows an equal sign character ('=') as the separator between the key and value, but your DPL pattern is using the colon character (':'). I believe this is the most likely cause of your issue. The DQL shared by @cchanka above is amended accordingly and this change is the reason it works.