topic Re: Formating question and regex in Splunk Search

Formating question and regex

CYBR_AH — Wed, 16 Mar 2016 20:04:49 GMT

Hi All,

I'm trying to search for start up and shutdown message of AWS instances and build a nice table. On my test instance, the first message on the /var/log/message is the following line when I run 'earliest=-4h@h "start" | regex _raw="rsyslogd:.*" | table _raw'

Mar 16 14:42:58 ip-10-0-0-2 rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="899" x-info="http://www.rsyslog.com"] start

I'd like to break this down and just keep.

_time, IP, Command
timestamp, 10.0.0.2, Start

Am I going about this the wrong way?

Re: Formating question and regex

somesoni2 — Wed, 16 Mar 2016 20:42:57 GMT

Try something like this (assuming you WANT to display these fields - _time, IP, Command)

earliest=-4h@h "start" | regex _raw="rsyslogd:.*" | rex "ip-(?<IP>\d+-\d+-\d+-\d+)\s[^\]]+\s+(?<Command>.*)" | table _time IP Command

Re: Formating question and regex

jkat54 — Wed, 16 Mar 2016 21:25:35 GMT

 earliest=-4h@h | rex field=_raw '(?<=swVersion..)(?<swversion>.*)" x-pid=.(?<pid>\d+)" x-info="(?<info>.*)"]' | table swVersion, pid, info

Re: Formating question and regex

jkat54 — Sat, 26 Mar 2016 18:46:09 GMT

Hey thanks for the upvote CYBR_AH, if it solved your problem please mark it as the answer too. Cheers!