topic Re: Rex for different pattern of same fields within same event in Splunk Search

Rex for different pattern of same fields within same event

sh254087 — Wed, 30 Sep 2020 01:20:16 GMT

Trying to formulate a Regex that would work with events something like the below one. When I tried extracting the fields, I did not get to the expected output as the field name I'm looking at is same for values of different pattern. The rex was either failing or throwing error about using duplicate field name.

Sample Event entry:
No machines for project Print-Demo
No machines for project Kimkeen_POC
No machines for project Default Project
Project name: ABCD Life, Machine name:hlstocpra2, Status:STARTED, Backlog bytes:0, Last consistency:Still replicating
Project name: ABCD Life, Machine name:HKWONDERSVD02, Status:PAUSED, Backlog bytes:0, Last consistency:Still replicating
Project name: ABCD Life, Machine name:hlstocpraw2, Status:PAUSED, Backlog bytes:0, Last consistency:Still replicating
No machines for project Print
No machines for project Demo2
No machines for project Test_migrate

Expected extraction and output:

Looking for help in extracting the fields with all the values to be presented in individual rows.

Re: Rex for different pattern of same fields within same event

sh254087 — Thu, 18 Jul 2019 13:06:51 GMT

Please help @niketnilay
@shwetas

Re: Rex for different pattern of same fields within same event

gcusello — Thu, 18 Jul 2019 13:19:19 GMT

Hi sh254087,
I suggest to use two different regexes, one for No machines and one for machines the merge machine name fields using coalesce, in othe words:

| rex "(No machines for project )(?<Project_Name1>.*)"
| rex "(?ms)Project name: (?<Project_Name2>[^,]*), Machine name:(?<Machine_Name>[^,]*), Status:(?<Status>[^,]*), Backlog bytes:(?<Backlog_bytes>[^,]*)"
| eval Project_name=coalesce(Project_name1,Project_name2)

you can test it at https://regex101.com/r/X3pgrK/2

Bye.
Giuseppe

Re: Rex for different pattern of same fields within same event

wenthold — Thu, 18 Jul 2019 16:10:02 GMT

I'm not sure if you should use a more complex single rex command, but you can:

| rex "[Pp]roject (?:name: )?(?<ProjectName>[^\,\r\n]+)(?:\, Machine name\:(?<MachineName>[^\,]+)\, Status\:(?<JobStatus>[^\,]+)\, Backlog bytes\:(?<BacklogBytes>[0-9]+)\, Last consistency\:(?<LastConsistency>.*))?"
| table ProjectName, MachineName, JobStatus, BacklogBytes, LastConsistency