topic Re: regex extraction in Splunk Search

regex extraction

indeed_2000 — Tue, 29 Jun 2021 08:00:10 GMT

from this log:

23:52:52.758 alex appinfo: Terminating due to signal: 1

How can I extract these item with rex:

user=alex

appname=appinfo

signal=1

Thanks,

Re: regex extraction

kamlesh_vaghela — Tue, 29 Jun 2021 08:19:39 GMT

@indeed_2000

Can you please try this?

YOUR_SEARCH| rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<user>\w+)\s(?<appname>\w+).*signal\:\s(?<signal>.*)"

My Sample Search :

| makeresults |eval _raw="23:52:52.758 alex appinfo: Terminating due to signal: 1" | rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<user>\w+)\s(?<appname>\w+).*signal\:\s(?<signal>.*)"

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: regex extraction

ITWhisperer — Tue, 29 Jun 2021 08:58:20 GMT

| rex "\S+\s(?<user>\S+)\s(?<appname>\S+):\s.*?signal:\s(?<signal>\d+)"

Re: regex extraction

indeed_2000 — Tue, 29 Jun 2021 09:03:51 GMT

it work separately but not work all in same time

Worked

rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<user>\w+)
rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<appname>\w+)
rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3} .*signal\:\s(?<signal>.*)"

Not worked

| rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<user>\w+)\s(?<appname>\w+).*signal\:\s(?<signal>.*)"

any idea?

Thanks

Re: regex extraction

kamlesh_vaghela — Tue, 29 Jun 2021 09:28:06 GMT

@indeed_2000

It's working for me on your given sample data. Can you please share those sample events which are not extracting?