topic Rex multiple strings from field query in Splunk Search

Rex multiple strings from field query

stephenreece — Thu, 11 Jul 2019 07:19:48 GMT

Morning all,

I hope this is an easy one where i am just missing some login somewhere.

I have a field called errors that houses data that looks like this:

*Fieldname *

errors

String
56005:16;69002:1;56009:3958

This is indicating that a single event can incur multiple errors and i need to pull all the error codes separately (codes are always numerical and always 5 digits long).

The colon and digits after indicate count volumes which are irrelevant and the delimiter is always a semi-colon.

This seems quite an easy pull as the rex is simply "(\d\d\d\d\d):"

However i can't get splunk to spit anything out at all (and ive tried lots of variations).

Ideally i want to stats value the result by user so i end up with something like the below:

user1 56005
56002
69009
User2 66095
56077

any ideas?:

Re: Rex multiple strings from field query

stephenreece — Thu, 11 Jul 2019 07:29:47 GMT

current search = | rex field=errors "(?(\d\d\d\d\d):)"

Re: Rex multiple strings from field query

stephenreece — Thu, 11 Jul 2019 07:41:39 GMT

this will give back the first rex entry only, so i need a way to reproduce and collect an unlimited amount of REX groups.. (each string may contain from 1 to 1000 codes).

Re: Rex multiple strings from field query

renjith_nair — Thu, 11 Jul 2019 12:11:34 GMT

@stephenreece

Try

|rex field=errors max_match=0 "(?<Errors>\d{5}):"