topic Re: Can you help me with the following regex please? in Splunk Search

Can you help me with the following regex please?

jip31 — Tue, 13 Nov 2018 09:29:38 GMT

I want to add a rex field in my search

index=windows sourcetype="wineventlog:system" SourceName="Disk" count="$process$"
  | dedup _time
| table _time host Type EventCode

There are 2 conditions for my rex field :

Une erreur a été détectée sur le périphérique \Device\Harddisk1\DR1 lors d'une opération de pagination.

\Harddisk\ has to finish by 0 or 1, but not by another number.

After \Harddisk0\ or \Harddisk1\ it's mandatory to have DR

Could you help me please??

Re: Can you help me with the following regex please?

FrankVl — Tue, 13 Nov 2018 09:42:05 GMT

Try this if you want to use the regex command to search for events that match those conditions:
| regex "\\Harddisk[0-1]\\DR"
https://regex101.com/r/F6AExN/1

Try this if you want to use the rex command to extract the harddiskname (only those matching your conditions):
| rex "\\(?<diskName>Harddisk[0-1])\\DR"
https://regex101.com/r/F6AExN/2

Re: Can you help me with the following regex please?

harsmarvania57 — Tue, 13 Nov 2018 09:43:46 GMT

Hi @jip31,

Please try below search, replace <FieldName> with actual field name.

 index=windows sourcetype="wineventlog:system" SourceName="Disk" count="$process$"
| dedup _time
| rex field=<FieldName> "\x5C\w+\x5C(?<extracted_disk>Harddisk(?:0|1))\x5CDR"
| where isnotnull(extracted_disk)
| table _time host Type EventCode extracted_disk

If you do not want extract Harddisk0 OR Harddisk1 in another field and only want to filter result based on those Harddisk value then use regex command.

 index=windows sourcetype="wineventlog:system" SourceName="Disk" count="$process$"
| dedup _time
| regex <FieldName>="\x5C\w+\x5C(Harddisk(?:0|1))\x5CDR"
| table _time host Type EventCode