topic Help with regex / replace needed in Splunk Search

Help with regex / replace needed

damucka — Thu, 07 Mar 2019 09:56:19 GMT

Hello,

I have the following event:

X Mon Mar  4 19:57:48:935 2019 X  *** WARNING => MMX 'EGPH5': mm_diagmode set 0 118: possible performance degradation #102400

WARNING could be also ERROR, I would like to handle both cases in one regex.

Now, I would like to:
1/ Skip the line beginning until the word WARNING / ERROR
2/ clear the event from all digits
3/ save the result into the "text"

For the digit clearing I have the following replace:

| eval text=replace(_raw,"\d{0}\d+","")

and it works fine. However I have issues with the skipping line until WARNING / ERROR. If I take the regex101, then the corresponding sed would be:

s/^(.*)\* //g

but when I apply it in the Splunk SPL it will do nothing:

| rex mode=sed "s/^(.*)\*//g"

.. not mentioning trying above in replace.

Could you please advice?
How would I skip the beginning of line and clear it from digits and assign to the text? Replace or sed, does not matter.

Kind Regards,
Kamil

Re: Help with regex / replace needed

vnravikumar — Thu, 07 Mar 2019 10:07:47 GMT

Hi @damucka

Try like and please let me know sample output that you want

| makeresults 
| eval _raw="X Mon Mar  4 19:57:48:935 2019 X  *** WARNING => MMX 'EGPH5': mm_diagmode set 0 118: possible performance degradation #102400" 
| eval text=replace(_raw,"\d{0}\d+","")| rex field=text mode=sed "s/^(.*)\*//g"

Re: Help with regex / replace needed

chrisyounger — Thu, 07 Mar 2019 10:08:15 GMT

What about this:

|makeresults | eval _raw = "X Mon Mar 4 19:57:48:935 2019 X *** WARNING => MMX 'EGPH5': mm_diagmode set 0 118: possible performance degradation #102400" | rex mode=sed field=_raw "s/\d+//" |rex mode=sed "s/^(.*?)\*+//g"