topic Re: Splunk regex query in Splunk Search

How to achieve this Splunk regex query?

sbsinha04 — Tue, 21 Jun 2022 18:08:59 GMT

This is the log i am getting in splunk

msg: 2022-01-22 03:00:00.143 INFO 15 --- [ scheduling-1PurgeProcessCountTask : engine:Engine12
Cleanable Process Instance Count {"exception_management_workflow":{"finishedCount":6621,"cleanableCount":1113}}

i want output like

Engine finishedProcessInstanceCount

Engine12 6621

Could you please help me on that, i am trying below query but not working

index=abc cf_app_name="DEV" |rex field=_raw "engine.(?<pam>.........) ,finishedProcessInstanceCount...(?<sam>..\d+)" | table pam, sam

Re: Splunk regex query

richgalloway — Mon, 20 Jun 2022 18:18:59 GMT

The example regex would work great if the engine name was followed immediately by a comma and the finished count, but that's not the case. While we could define a regex to extract both fields from the event, this is a good example of a time when multiple rex commands is easier to work with.

index=abc cf_app_name="DEV" | rex "engine:(?<pam>\w+)" | rex "finishedCount\\\":(?<sam>\d+)" | table pam, sam

Re: Splunk regex query

sbsinha04 — Mon, 27 Jun 2022 15:19:11 GMT

It's not working

Re: Splunk regex query

sbsinha04 — Mon, 27 Jun 2022 15:20:21 GMT

Query is not returning any data

Re: Splunk regex query

richgalloway — Mon, 27 Jun 2022 16:49:19 GMT

It works with the sample event provided in the OP.

| makeresults | eval _raw="msg: 2022-01-22 03:00:00.143 INFO 15 --- [ scheduling-1PurgeProcessCountTask : engine:Engine12 Cleanable Process Instance Count {\"exception_management_workflow\":{\"finishedCount\":6621,\"cleanableCount\":1113}}" | rex "engine:(?<pam>\w+)" | rex "finishedCount\\\":(?<sam>\d+)" | table pam, sam

If it's not working with real data then it's possible either or both of the regular expressions need to be modified to match the real data.