topic Re: How to extract a string in a variable in Splunk Search

How to extract a string in a variable

avneet26 — Mon, 22 Aug 2022 09:53:10 GMT

I have a table in which one of the columns has logs like below

2022-08-21 23:00:00.877 Warning: PooledThread::run: N4xdmp29ForestCheckSchemaDBChangeTaskE::run: XDMP-XDQPNOSESSION: No XDQP session on host iuserb.nl.eu.abnamro.com, client=iuserb.nl.eu.abnamro.com, request=moreLocators, session=2026168605646879816, target=5301003730415457210

I want to extract the term "XDMP-XDQPNOSESSION" into a variable and then later use it. How to do that using regex or any other option ?

Re: How to extract a string in a variable

isoutamo — Mon, 22 Aug 2022 10:08:48 GMT

one way to do it:

... your base query | rex "(::run:.*)+::run:(?<foo>[^:]+)"

Then you have this string on field foo.

r. Ismo

Re: How to extract a string in a variable

avneet26 — Mon, 22 Aug 2022 10:56:23 GMT

Basically out of my base query, I want to extract this string put it in a variable and then pass it to create an alert e-mail , where-in this string will be passed to the e-mail title. How can I do that?

Re: How to extract a string in a variable

avneet26 — Wed, 24 Aug 2022 11:41:20 GMT

what is run here?

Re: How to extract a string in a variable

ITWhisperer — Wed, 24 Aug 2022 11:56:35 GMT

"run" is taken from your example log event - it precedes "XDMP-XDQPNOSESSION" (the string you wanted to extract), but because it appears twice in your example, it needs to appear twice in the rex matching string to anchor the extract.