topic Re: issue in rex query in Splunk Search

issue in rex query

roopeshetty — Fri, 15 Feb 2019 07:36:10 GMT

Hi Guys,
I have a log as below;

server1;443 status= running.
server2;443 status= running.
server3;443 status= running.
server4;443 status= running.

In this I need to create a field by name “ServerName” by targeting all server names as its values example server1, server2, server3 etc.

I am running the rex query as below;
|rex "(?.*);443"

now i am getting the expected result but an additional text lines will be added onto its values as below;

Message=server1
Message=server2
Message=server3
Message=server4

Any idea from where this word “Message=” is being added to these values as prefix and how can we remove it?

renjith_nair — Fri, 15 Feb 2019 13:11:00 GMT

@roopeshetty ,

Looks like your group filed was removed from the question. Try to add code formatting whenever you add search strings.

Nevertheless, try this

rex "(?<server>.+);443"

vnravikumar — Fri, 15 Feb 2019 13:14:04 GMT

Hi @roopeshetty

Try with

^(?P<ServerName>.*);\d