topic Re: Parse words in a search result in Getting Data In

Parse words in a search result

gnoellbn — Wed, 16 Oct 2013 20:49:29 GMT

Hello,

I'm trying to extract data depending of one word (fail* or success*) from a field that is not always the same :

Oct 16 15:12:47 10.1.0.12 date=2013-10-16 time=15:12:47 devname=WIN_XP device_id=324156465 log_id=0000010001 type=event subtype=system pri=alert user=toto adom= msg="user 'toto' login failed from GUI(192.185.63.33)"

The info I am looking for is always in "msg=" but not always at the same place.

I have tried different way with the command below :

| stats count(eval(msg="fail")) as Failed

Thanks,

Re: Parse words in a search result

dmaislin_splunk — Wed, 16 Oct 2013 20:52:26 GMT

| rex "msg=\"(<YOURFIELD>.+?)\"" | stats count(YOURFIELD) as Failed | where YOURFIELD="*FAIL*"

Re: Parse words in a search result

gnoellbn — Thu, 17 Oct 2013 13:30:34 GMT

Hey,

Thanks for your answer, we were'nt able to extract the info as we wanted. The | stats part worked fine, it listed all the fields however the | where didn't. As a workaround we found the following :

| rex "msg=\".*(?<Etat>(failed|success)).*\"" | stats count by Etat

This works great for us as we get both fields as result (failed and success)

Thanks again,
Gaetan