topic Re: field extraction in Alerting

field extraction

sphiwee — Tue, 14 Sep 2021 22:37:17 GMT

I have the following log

!!! --- HUB ctxsdc1cvdi013.za.sbicdirectory.com:443 is unavailable --- !!! user='molefe_user' password='molefe' quota='user' host='002329bvpc123cw.branches.sbicdirectory.com' port='443' count='1' !!! --- HUB 002329bvpc123cw.branches.sbicdirectory.com:443 is unavailable --- !!! host='005558bvpc5ce4w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 005558bvpc5ce4w.za.sbicdirectory.com:443 is unavailable --- !!! host='41360jnbpbb758w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 41360jnbpbb758w.za.sbicdirectory.com:443 is unavailable --- !!! host='48149jnbpbb041w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 48149jnbpbb041w.za.sbicdirectory.com:443 is unavailable --- !!! user='pips_lvl_one_user' password='pips_lvl_one' quota='user'

I have above log and I'm struggling to extract the colored items
ctxsdc1cvdi013.za.sbicdirectory.com = as workstation ID
is unavailable = as status
molefe = as quota

Re: field extraction

bowesmana — Tue, 14 Sep 2021 22:49:04 GMT

Run this search and check the rex statement

| makeresults | eval _raw="!!! --- HUB ctxsdc1cvdi013.za.sbicdirectory.com:443 is unavailable --- !!! user='molefe_user' password='molefe' quota='user' host='002329bvpc123cw.branches.sbicdirectory.com' port='443' count='1' !!! --- HUB 002329bvpc123cw.branches.sbicdirectory.com:443 is unavailable --- !!! host='005558bvpc5ce4w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 005558bvpc5ce4w.za.sbicdirectory.com:443 is unavailable --- !!! host='41360jnbpbb758w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 41360jnbpbb758w.za.sbicdirectory.com:443 is unavailable --- !!! host='48149jnbpbb041w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 48149jnbpbb041w.za.sbicdirectory.com:443 is unavailable --- !!! user='pips_lvl_one_user' password='pips_lvl_one' quota='user'" | rex "!!! --- HUB (?<workstationId>[^:]*):\d+\s(?<status>[^-]*).*?password='(?<quota>[^']*)"

However, did you want the password molefe to be the quota?

Also, this was posted as a single line log message and you only wanted those 3 fields - was that correct - the rex statement will get those.

However, it assumes the :port number will always be present. regex would need to change if that's not the case.

Re: field extraction

sphiwee — Wed, 15 Sep 2021 07:18:20 GMT

Hi the port will always be the same, however when I run this regex command in my search it doesnt extract anything

Quota I think it was extracted automatically and its wrong hence I wanted the regex way

Re: field extraction

sphiwee — Wed, 15 Sep 2021 09:28:59 GMT

Can I also get the results of your search

Re: field extraction

bowesmana — Wed, 15 Sep 2021 22:19:15 GMT

Can you provide your search and an exact replica of your data. If that rex statement does not work in your environment, then the data you provided in your original post is not the same as the data in your search.