topic Re: Rex problem in Splunk Search

Rex problem

henderz — Mon, 04 May 2020 14:41:52 GMT

Hey
I'm trying to extract the values from _time to new fields (Year, Month, Day), in order to compare average of events during current month to last 3 months, but it seems like they do not get any value.

here is my search:

 'soc_events'
    | search * Rule_Name="*"
    | eval mytime=strftime(_time, "%Y/%m/%d") 
    | rex field=mytime "(\"?<Year>\d+)/(?<Month\d+)/(?<Day>\d+)\""
    | stats count as Count by Year,Month,Day
    | sort Year,Month,Day
    | eventstats last(Month) as Current_Month last(Year) as Current_Year 
    | where Month!=CurrentMonth OR Year!=Current_Year
    | stats avg(Count) as DayAveravge values(Month) as Months by Day

Re: Rex problem

richgalloway — Mon, 04 May 2020 14:59:24 GMT

The regular expression does not match the data. Since the 'mytime' field does not contain quotation marks, they should not be in the rex command. Try | rex field=mytime "(?<Year>\d+)/(?<Month>\d+)/(?<Day>\d+)".

That's not all. Once you filter out all events from the current year using | where Month!=CurrentMonth OR Year!=Current_Year you're likely to have nothing left.

What problem is this query trying to solve?

Re: Rex problem

henderz — Mon, 04 May 2020 15:04:31 GMT

well as i said i'm trying compare average of events during current month to last 3 months

i did few changes that helped a little :

 'soc_events'
     | search * Rule_Name="*"
     | eval mytime=strftime(_time, "%Y/%m/%d") 
     | rex field=mytime "("?<Year>\d+)/(?<Month\d+)/(?<Day>\d+)""
     | stats count as Count by Year,Month,Day
     | sort Year,Month,Day
     | eventstats last(Month) as Current_Month last(Year) as Current_Year 
     | where Month!=Current_Month OR Year!=Current_Year
     | stats avg(Count) as DayAveravge values(Month) as Months by Day

but now the query does not compare the previous months to this one like i wanted it to

Re: Rex problem

richgalloway — Wed, 30 Sep 2020 05:12:23 GMT

I don't see the differences in the latest query.

The events of the last 3 months will all have Year==2020 and Current_Year==2020. Therefore, they will all fail where Year!=Current_Year and will not be displayed.