topic Re: RegEx How to find two strings from splunk log in Splunk Search

RegEx How to find two strings from splunk log

dabroma5 — Wed, 30 Sep 2020 04:51:11 GMT

I have below log:

Service ABCD(blabla_blabla): 365.45.1.87.3.60354 -> remote.234.5 Failure
Service DERF(blabla_blabla): remote.567.9 -> remote.284.9 Failure

and would like to catch with RegEx:

a: 365.45.1.87.3.60354 b: remote.234.5

a: remote.567.9 b: remote.284.9

Thanks for help

Re: RegEx How to find two strings from splunk log

vnravikumar — Wed, 01 Apr 2020 14:20:55 GMT

Check this

| makeresults 
| eval log="Service ABCD(blabla_blabla): 365.45.1.87.3.60354 -> remote.234.5 Failure#Service DERF(blabla_blabla): remote.567.9 -> remote.284.9 Failure" 
| eval temp=split(log,"#") 
| mvexpand temp 
| rex field=temp "\:\s+(?P<a>[^->]+)\s+->\s+(?P<b>\S+)" 
| table a b

Re: RegEx How to find two strings from splunk log

gcusello — Wed, 01 Apr 2020 14:21:25 GMT

Hi @dabroma5
try this regex:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)"

that you can test at https://regex101.com/r/fOwXfs/1

if eventually you have some false positive, you could also try:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)\s+Failure"

that you can test at https://regex101.com/r/fOwXfs/2

Ciao.
Giuseppe

Re: RegEx How to find two strings from splunk log

efavreau — Wed, 01 Apr 2020 14:52:26 GMT

@gcusello your response was crazy fast! Awesome!

Re: RegEx How to find two strings from splunk log

gcusello — Wed, 01 Apr 2020 14:58:28 GMT

Hi @dabroma5
you're welcome!
Ciao and next time.
Giuseppe