topic Re: rex command to extract in Splunk Search

rex command to extract

sphiwee — Tue, 07 Jul 2020 11:36:03 GMT

[2020-07-07 12:40:01+0200] workspace_sandbox RUNNING pid 17159, uptime 21 days, 21:43:58

i have this line of log but i want to extract only workspace_sandbox as a field called Services

im using rex "(^(?<Service>\s\s\w+.\w+))\s\s" but having no luck.

Also want to extract "Running" as status

to4kawa — Tue, 07 Jul 2020 11:46:21 GMT

| rex "\]\s(?<Service>\S+) (?<status>\S+)"

sphiwee — Tue, 07 Jul 2020 11:57:05 GMT

This is what i get, dont think it has to be like this.. any ideas?

gcusello — Tue, 07 Jul 2020 12:02:34 GMT

please, try this

| rex "\]\s+(?<service>[^ ]+)\s+(?<status>[^ ]+)"

Ciao.

Giuseppe

sphiwee — Tue, 07 Jul 2020 12:40:06 GMT

thanks, you're a legend.

gcusello — Tue, 07 Jul 2020 12:59:06 GMT

You're welcome!

Karma Points are appreciated.

Ciao.

Giuseppe