topic Re: Need help on rex in Splunk Search

Need help on rex

rishiaggarwal — Mon, 15 Feb 2016 02:35:48 GMT

Hi Team,

Need help to extract fields for the following. Please help rex for the below.

    'ConnID'    '007202761fdb2c01'
    'VirtualQueue'  'ABC_EFG_BJFNKJFN'

renjith_nair — Mon, 15 Feb 2016 02:45:02 GMT

@rishiaggarwal , Is that the full event ? Also please clarify what you want to extract

Amohlmann — Mon, 15 Feb 2016 03:05:10 GMT

Is that the full event? Which part are you trying to extract? What are the names of the fields here?

esix_splunk — Mon, 15 Feb 2016 03:47:20 GMT

If these are single line events:

\'ConnID\'\s+\'(?<ConnID>[^\']+)'

And

\'VirtualQueue\'\s+\'(?<VirtualQueue>[^\']+)'

Multiline events are a bit different. You need to make sure that the events are process properly as multiline, then you can do something like..

  (?m) \'ConnID\'\s+\'(?<ConnID>[^\']+)'\n\'VirtualQueue\'\s+\'(?<VirtualQueue>[^']+)'