topic Re: need help in displaying specific fields from below output in Splunk Search

need help in displaying specific fields from below output

rkdasari — Tue, 29 Sep 2020 07:49:36 GMT

Need help in displaying Client and /use71-mobstor-bf1/vol070 with dedup, as logs has similar entries.

Nov 2 19:13:54 netapp-master9.bkp.bf1.yahoo.com NetVault[2655]: NetVault: Client: 'netapp_master9_bkp_bf1' Class: 'Data Plugin' Job: '21483' Warnlevel: 'Error' Msg: 'NDMP: ERROR 1: DATA: Operation terminated: Backup of non-local Volume '/use71-mobstor-bf1/vol070' not supported (for /use71-mobstor-bf1/vol070)'

Nov 2 18:44:02 netapp-master9.bkp.bf1.yahoo.com NetVault[2655]: NetVault: Client: 'netapp_master9_bkp_bf1' Class: 'Data Plugin' Job: '21483' Warnlevel: 'Error' Msg: 'NDMP: ERROR 1: DATA: Operation terminated: Backup of non-local Volume '/use71-mobstor-bf1/vol070' not supported (for /use71-mobstor-bf1/vol070)'

ov 2 01:14:15 netapp-master9.bkp.bf1.yahoo.com NetVault[2655]: NetVault: Client: 'netapp_master9_bkp_bf1' Class: 'Data Plugin' Job: '22191' Warnlevel: 'Error' Msg: 'NDMP: ERROR 1: DATA: Operation terminated: Backup of non-local Volume '/use71-mobstor-bf1/vol178' not supported (for /use71-mobstor-bf1/vol178)

Expecting output like below:

netapp_master9_bkp_bf1 /user71-mobstor-bf1/vol178 vol178 (as i need to run a query for vol178 value)

Thanks,
Ram

Re: need help in displaying specific fields from below output

rphillips_splk — Fri, 06 Nov 2015 18:06:30 GMT

Hi Ram are Client and Volume already extracted fields or do you also need help with the regex to extract these fields?

Re: need help in displaying specific fields from below output

sundareshr — Fri, 06 Nov 2015 21:07:19 GMT

Try this command to extract the fields and display

| rex "Client:\s'(?[^']+).*Volume\s'(?[^']+)" | dedup volume | table client volume

Re: need help in displaying specific fields from below output

rkdasari — Mon, 09 Nov 2015 10:00:26 GMT

No they are not extracted fields, i need to fetch those using regex. I have tried below command but its giving error.
"Error in 'rex' command: Encountered the following error while compiling the regex 'Client:s'(?[^']+).*Volume'(?[^']+)': Regex: unrecognized character after (? or (?- "

| rex "Client:s'(?[^']+).*Volumes'(?[^']+)" | dedup volume | table client volume

Re: need help in displaying specific fields from below output

rkdasari — Mon, 09 Nov 2015 11:50:46 GMT

thanks for sharing the command but, it is giving below error.

"Error in 'rex' command: Encountered the following error while compiling the regex 'Client:s'(?[^']+).*Volume'(?[^']+)': Regex: unrecognized character after (? or (?- "

Re: need help in displaying specific fields from below output

sundareshr — Mon, 09 Nov 2015 14:57:10 GMT

I just tested this and get the desired results. Test this and let me know if you get the same error. This time I entered it as a code sample... Learn something new everyday 🙂

index=* | head 1 | eval s="Nov 2 18:44:02 netapp-master9.bkp.bf1.yahoo.com NetVault[2655]: NetVault: Client: 'netapp_master9_bkp_bf1' Class: 'Data Plugin' Job: '21483' Warnlevel: 'Error' Msg: 'NDMP: ERROR 1: DATA: Operation terminated: Backup of non-local Volume '/use71-mobstor-bf1/vol070' not supported (for /use71-mobstor-bf1/vol070)'" | rex field=s "Client:\s'(?<client>[^']+).*Volume\s+'(?<volume>[^']+)" | dedup volume | table s client volume

Re: need help in displaying specific fields from below output

rkdasari — Tue, 10 Nov 2015 07:49:42 GMT

yes it is displaying client and volume in a table format when i run above command that is awesome, but when i try to run this command non-local Volume host="netapp-master9.bkp.bf1.yahoo.com" | rex field=s "Client:\s'(?[^']+).*Volume\s+'(?[^']+)" | dedup volume | table client volume

it is giving error "No Results Found", i am also trying to do modifications on syntax. Yes learning something new is always excited 🙂

Thanks,
Ram

Re: need help in displaying specific fields from below output

rkdasari — Tue, 10 Nov 2015 07:52:32 GMT

Hurray i got it, thank you very much for your guidance finally i got the output what i am looking for.

non-local Volume host="netapp-master9.bkp.bf1.yahoo.com" | rex "Client:\s'(?[^']+).*Volume\s+'(?[^']+)" | dedup volume | table client volume