Username or Email Address
A new functionality appears a few months ago on OMS, with the possibility to create a custom field. It’ll give you the possibility to class simply and quickly your custom search.
To start, be sure to have an OMS workspace and to get logs:
Verify in the search that you have some logs available:
Select a log that interests you and for who you want to create a custom field. I’ll select a log about the restart of a service:
Click on … just beside ParameterXml (you can do it in another category if you want) and choose Extract fields from ‘Event’ (Preview):
You’ll arrive on a selection page, like this:
Select the part that interests you, give him a name and click on Extract:
Automatically, OMS will search in current logs if it founds correspondence. If it has, it will automatically pass them in blue. If it’s not done automatically, or if it misses a text part, click on the 3 small points and choose Modify this highlight:
Select the text and associate it with the custom field created previously:
When all results of the search are associated with a custom field, click on Save Extraction:
Do the same with the service status, stopped or running:
From now, every time that a service will be restarted, custom field will be applied automatically. Unfortunately, these custom fields do not apply on logs generated before the creation.
When it’s done, you can use your custom fields in the search:
And use them in a personal view:
This functionality is very interesting to class logs and has a quick overview, quick and automated without using PowerShell scripts or others that are heavy to deploy.
If you’ve any questions, feel free to contact me 🙂
Microsoft, Services by Florent Appointaire