topic Re: rex to extract a field in Splunk Search

rex to extract a field

Mohsin123 — Wed, 20 Dec 2017 08:53:01 GMT

How do I extract connection attempt failed from the below log

2017-12-20T07:51:05.847Z I REPL [ReplicationExecutor] Error in heartbeat request to 10.78.33.13:8191; Location18915 Failed attempt to connect to 10.78.33.13:8191; couldn't connect to server 10.78.33.13:8191 (10.78.33.13), connection attempt failed

Re: rex to extract a field

harsmarvania57 — Wed, 20 Dec 2017 12:41:21 GMT

Hi,

Can you please try <yourBasesearch> | rex ".*,\s(?<status>.*)", this will extract connection attempt failed in new field called status

Re: rex to extract a field

gcusello — Wed, 20 Dec 2017 12:41:34 GMT

Hi shraddhamuduli,
which information do you want to extract?
if you want to extract the message "connection attempt failed", it's easy

| rex ".*\),(?<my_field>.*)$"

if you want to extract other fields (e.g. server and port failed), it's

| rex ".*server\s(?<ip>\d+\.\d+\.\d+\.\d+):(?<port>\d+)"

Bye.
Giuseppe

Re: rex to extract a field

nickhills — Tue, 29 Sep 2020 17:23:16 GMT

try this:
(?<err_message>Error.+;).+,(?<err_reason>.+)

It will extract two fields - err_message and err_reason