Need help on Rex filter

jerinvarghese — Mon, 06 Dec 2021 09:33:22 GMT

Hi All,

Need help in getting the right rex filter for the below _raw data.

2021-12-04T01:29:48.015524+00:00 USHCO-EXXON, ipsec-ike-down, 689, "IKE connection with peer 10.218.42.113 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:15.007722+00:00 USHCO-EXXON, ipsec-tunnel-down, 687, "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:15.007722+00:00 USHCO-EXXON, ipsec-ike-down, 686, "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:14.807814+00:00 USHCO-EXXON, ipsec-tunnel-down, 872, "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB 2021-12-04T01:29:14.807814+00:00 USHCO-EXXON, ipsec-ike-down, 871, "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB

Above is the raw data.

Requirement :

All the content within " " need to filtered.

Example

"IKE connection with peer 10.218.42.113 (routing-instance EXXON-Control-VR) is up" "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up" "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up" "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up" "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up"

Above content to be filtered into Event_Log

| rex field=_raw "(?<Event_Log>[^"]+)"

But something am missing, its not capturing the data

Re: Need help on Rex filter

gcusello — Mon, 06 Dec 2021 09:44:28 GMT

Hi @jerinvarghese,

what do you really intend with filter?

do you want to extract the strinbgs between quotes in a field or don't display them?

if you want to put in a field called "Event_Log", you could use a regex like this:

| rex "\"(?<Event_Log>[^\"]+)\""

you can test the regex at https://regex101.com/r/hkPiCZ/1

ciao.

Giuseppe

topic Re: Need help on Rex filter in Splunk Search

Need help on Rex filter

Re: Need help on Rex filter