topic Re: Get instance name from source in Splunk Search

Get instance name from source

bcalder — Mon, 01 Mar 2021 14:50:19 GMT

Hi all,

I am completely new to Splunk so I apologize if this has been asked/answered. I did review the past discussions but could not find a solution to my question.

I have incoming logs that look similar to this

28 Feb 2021 13:53:23,815[MANDATORY][JAS]Initiating EnterpriseOne startup using configuration location (default_path) as 'C:\jde_home\SCFHA\targets\HTML_PD1_82\config'.

I would like to be able to search for the string "Initiating EnterpriseOne startup " and create a dashboard table showing the date, time and the substring HTML_PD1_82. The idea being, I would like to keep track of when each machine was restarted.

Can anyone help with the Search pattern? Thanks in advance.

Bruce

Re: Get instance name from source

richgalloway — Mon, 01 Mar 2021 15:54:33 GMT

Perhaps this will get you started.

index=foo "Initiating EnterpriseOne startup" | rex "targets\\\(?<machine>[^\\\]+)" | table _time machine

Re: Get instance name from source

bcalder — Mon, 01 Mar 2021 16:54:19 GMT

Thanks @richgalloway That worked great. I ended up with

index=* "Initiating EnterpriseOne startup"
| rex "targets\\\(?<machine>[^\\\]+)" | table machine _time
| dedup machine
| sort machine

As newbie, I appreciate your input.

I'm sure there is documentation out there somewhere. Now if I can just find it. ;^o

Bruce

Re: Get instance name from source

richgalloway — Mon, 01 Mar 2021 18:23:45 GMT

For documentation, see https://docs.splunk.com/Documentation/Splunk/8.1.2/Search/GetstartedwithSearch and https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/WhatsInThisManual