topic Re: Rex query in Splunk Search

Rex query

harishnpandey — Tue, 18 Jul 2017 20:57:38 GMT

For below input I tried search query as

index=myindex "Notification"|rex "(MQ) (?\d+) = (?\w+)"|stats count(Notification)
However, its not working says "no result found". The moment I take off ==> stats count(Notification)
it shows values

Input:
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = EMAIL
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = SMS
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = VOICE
Output

Notification Type TypeCode
MQ EMAIL
MQ SMS
MQ VOICE

Re: Rex query

somesoni2 — Tue, 18 Jul 2017 21:07:06 GMT

You query is truncated. Please edit the question to add the query again and ensure that you select the query and click on button "101010" OR press Ctrl+K to format the code (to retains all formatting/content). Do the same for your raw data and output

Re: Rex query

DalJeanis — Tue, 18 Jul 2017 21:22:19 GMT

Okay, reading what I can read, i don't see why it would succeed.

Your rex is looking for a decimal number after (MQ) and before the =, which is not in your data.

Something like this should pull the two fields...

| rex "Notification Type \((?<NotifType>[^\)]*)\) = (?<TypeCode>\w+)"

Re: Rex query

harishnpandey — Wed, 19 Jul 2017 11:01:39 GMT

Thank you Jean. I figured out my mistake with your help 🙂