topic field extraction in Alerting

field extraction

sphiwee — Wed, 15 Sep 2021 17:06:32 GMT

| makeresults

| eval _raw="!!! --- HUB ctxsdc1cvdi013.za.sbicdirectory.com:443 is unavailable --- !!! user='molefe_user' password='molefe' quota='user' host='002329bvpc123cw.branches.sbicdirectory.com' port='443' count='1' !!! --- HUB 002329bvpc123cw.branches.sbicdirectory.com:443 is unavailable --- !!! host='005558bvpc5ce4w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 005558bvpc5ce4w.za.sbicdirectory.com:443 is unavailable --- !!! host='41360jnbpbb758w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 41360jnbpbb758w.za.sbicdirectory.com:443 is unavailable --- !!! host='48149jnbpbb041w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 48149jnbpbb041w.za.sbicdirectory.com:443 is unavailable --- !!! user='pips_lvl_one_user' password='pips_lvl_one' quota='user'"

| rex "!!! --- HUB (?[^:]*):\d+\s(?[^-]*).*?password='(?[^']*)"

I'm running above rex command on splunk, it works when using it with "makeresults" command but when Im using it in my search it doesnt bring back any results

Re: field extraction

ashvinpandey — Wed, 15 Sep 2021 17:26:43 GMT

@sphiwee what are you looking to extract here ?

Re: field extraction

sphiwee — Wed, 15 Sep 2021 17:42:15 GMT

!!! --- HUB ctxsdc1cvdi013.za.sbicdirectory.com:443 is unavailable --- !!! user='molefe_user' password='molefe' quota='user' host='002329bvpc123cw.branches.sbicdirectory.com' port='443' count='1' !!! --- HUB 002329bvpc123cw.branches.sbicdirectory.com:443 is unavailable --- !!! host='005558bvpc5ce4w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 005558bvpc5ce4w.za.sbicdirectory.com:443 is unavailable --- !!! host='41360jnbpbb758w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 41360jnbpbb758w.za.sbicdirectory.com:443 is unavailable --- !!! host='48149jnbpbb041w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 48149jnbpbb041w.za.sbicdirectory.com:443 is unavailable --- !!! user='pips_lvl_one_user' password='pips_lvl_one' quota='user'"

The text highlighted red, first one as "Workstation", second one as "Quota" , third one as "status"

Re: field extraction

ashvinpandey — Wed, 15 Sep 2021 18:37:45 GMT

@sphiwee

Use below 3 lines in your search query and 3 new fields will be extracted:

| regex field=_raw "HUB\s(?P<Workstation>.*?)\:" | regex field=_raw "user\=\'(?P<user>.*?)\'" | regex field=_raw "443\s(?P<status>.*?)\-"

Also, If this reply helps you, an upvote would be appreciated.