topic Re: Extracting Text/Field from _raw Microsoft Event For Failed Backups in Knowledge Management

Extracting Text/Field from _raw Microsoft Event For Failed Backups

SplunkLunk — Mon, 27 Nov 2017 19:11:33 GMT

Greetings,

I want to run a report/alert when a MSSQL backup job has failed. It looks like the info I want is only displayed in the _raw field. Can anyone tell me how I can use the rex command to get the name of the database that has failed? The _raw event data looks like this:

2017-11-27 12:34:33.71 Backup BACKUP failed to complete the command BACKUP DATABASE WideWorldImportersDW. Check the backup application log for detailed messages.

The name of the database in this case is "WideWorldImportersDW". However, other database names will always be sandwiched between "BACKUP DATABASE" and ". Check" Can someone help me craft the rex expression to give me the text between "BACKUP DATABASE" and ". Check"? Thanks for any assistance.

Re: Extracting Text/Field from _raw Microsoft Event For Failed Backups

SplunkLunk — Mon, 27 Nov 2017 19:28:08 GMT

So, this is what I've tried and it seems to work:

|rex field=_raw "BACKUP DATABASE (?[^\s]+). Check"

Is there a better way? I'm not sure if this will miss any events. Maybe there is a better way.

Re: Extracting Text/Field from _raw Microsoft Event For Failed Backups

woodcock — Mon, 27 Nov 2017 20:37:02 GMT

Do this:

Your Search Here
| rex "BACKUP DATABASE (?<DBName>\S+). Check"
| search NOT DBName="*"

Refine your rex until none of your events are making it past the last search filter line.