topic How to extract 2 fields using rex? in Splunk Search

How to extract 2 fields using rex?

LizAndy123 — Mon, 14 Mar 2022 18:30:41 GMT

Hi, I am new to SPL and have figured out how to do one rex Field extract - like this

index=xxxxx "PUT /app/1/projects" | rex field=_raw "HTTP\/1\.1\" (?P<Status_Code>[^\ ]*)"

this is from the following search results log line HTTP/1.1" 200 44 188

This gives me the Status code and I can sort them and report - example 200 , 201, 400 or 500

I need to use the last field (2 or 3) digits to get the speed - how would I do that - I am stuck with formatting

Thanks in advance

yuanliu — Fri, 10 Dec 2021 21:35:40 GMT

this is from the following search results log line HTTP/1.1" 200 44 188

How about

| rex "HTTP/1.1\"\s+(?<Status_Code>\d+)\s+(?<field2>\d+)\s+(?<field3>\d+)"

ITWhisperer — Fri, 10 Dec 2021 21:35:54 GMT

| rex "HTTP\/\d\.\d\"\s(?<Status_Code>\d+).*?(?<speed>\d+)$"

LizAndy123 — Mon, 14 Mar 2022 18:03:09 GMT

Thanks this worked - I never came back on to say