topic Re: rex on rex101 works fine...Splunk returns a blank in Splunk Search

rex on rex101 works fine...Splunk returns a blank

he204035 — Tue, 01 Feb 2022 23:13:44 GMT

I have a rex built that when plugged into rex101 works fine, but when applied via a Splunk query, returns a blank result.

Text:

2022/02/01 23:07:26.979 [ERROR] [nrfClient.Discovery.nrf] Message send failed, response [Type:ABC Http2_Status:404 CauseCode:"CONTEXT_NOT_FOUND" RetryExhausted:true MsgType:1434 ServiceName:nabc SelectedProfileName:"abc-profile" FailureProfile:"FHABC" GroupID:"ABC-*" ]

rex:

Http2_Status:\d{3}\sCauseCode:\"(?<Error2>\w+)\"\s

rex101 result:

CONTEXT_NOT_FOUND

But when plugged into Splunk, it comes back with a blank result.

Re: rex on rex101 works fine...Splunk returns a blank

ITWhisperer — Tue, 01 Feb 2022 23:19:01 GMT

The rex works in splunk also

Which version of splunk are you using?

Re: rex on rex101 works fine...Splunk returns a blank

he204035 — Tue, 01 Feb 2022 23:29:17 GMT

Splunk Enterprise

Version:8.1.5

Re: rex on rex101 works fine...Splunk returns a blank

he204035 — Tue, 01 Feb 2022 23:39:03 GMT

Splunk Enterprise version 8.1.5

Re: rex on rex101 works fine...Splunk returns a blank

he204035 — Wed, 02 Feb 2022 14:10:59 GMT

Using Splunk Enterprise 8.1.5

Re: rex on rex101 works fine...Splunk returns a blank

he204035 — Wed, 02 Feb 2022 15:19:44 GMT

Error2 just shows up blank.

Re: rex on rex101 works fine...Splunk returns a blank

ITWhisperer — Wed, 02 Feb 2022 15:24:49 GMT

Something in your _raw field does not match the regex - can you paste the _raw field into a code block </> or something like notepad to ensure there are no gotchas e.g. null bytes, tabs in stead of spaces, extra spaces, etc.

Re: rex on rex101 works fine...Splunk returns a blank

he204035 — Wed, 02 Feb 2022 15:33:47 GMT

When I paste into Notepad, it just prints as one long line, nothing weird showing up. Maybe I need to try to do a split instead. It's just that the "Http2_status" doesn't always show up in the same place in the log outputs.