NOT ABLE TO PARSE SPECIFIC CHUNK OF LOG USING GROK

Hi, I have a sample log from a switch. I am trying to parse it in to fields but some how I dont know why it is not allowing me to parse capital letters like let me show you


Now this is when I worte PROG then it takes out the whole in to that
but when I try to write WORD instead of that then it failed to parse as screenshot is given below.

Since I have noticed that normally %{WORD} is used to parse capital and small alphabets right but in this case I am trying to parse PHY in this case and I am not able to view that in the fields.

Can any one help me to locate the error.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.