topic Re: Regex Help in Dashboards & Visualizations

Regex Help

alan20854 — Wed, 13 Jul 2016 20:34:28 GMT

Hello,

I am trying to create a table on my dashboard with the time stamp and the buildID. However, I am having regex trouble with my search.

Here is the search without the field extraction: host= x source= x "PDD_BUILDID". These events contain the buildID in a format such as [BUILDID=APP-2016.8-20160712194753]

This is my current search:

host= x source= x  "PDD_BUILDID"|rex field=_raw "BUILDID=(?P<build>\w*\d*\w*\d*\w*\d*)\x5D" | table build

I would like my table to contain the time and buildIDs such as APP-2016.8-20160712194753.

What am I doing wrong?

Re: Regex Help

sundareshr — Wed, 13 Jul 2016 20:42:57 GMT

Try this

 host= x source= x  "PDD_BUILDID"|rex field=_raw "BUILDID=(?P<build>[^\]]+)" | table build

Re: Regex Help

somesoni2 — Wed, 13 Jul 2016 20:43:44 GMT

Try like this

 host= x source= x  "PDD_BUILDID"|rex field=_raw "BUILDID=(?P<build>[^-]+-[^-]+)-(?<time>\d+)" | table build time | rex mode=sed field=time "s/(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})/\1-\2-\3- \4:\5:\6/g"