topic Re: Capturing specific string from log using regex in Splunk Search

Capturing specific string from log using regex

freephoneid — Sun, 02 Oct 2011 18:59:58 GMT

Hi,

I've below log lines in below format:

[2011-09-30 23:33:20:465 GMT+00:00][F3951B38F4DF45440927EDF522D5C9FF.http-8080-3][com.abc.xyz.MyWrapper] DEBUG alive?=false native?=true vision?true

How can I get the values of alive, native & vision variables? Please note that after vision?, there is no "=" sign. Log is not consistent. I also want to count how many of them are with alive &whats the count for native & vision...

Appreciate your help!

Thanks!

Re: Capturing specific string from log using regex

Ayn — Sun, 02 Oct 2011 19:48:05 GMT

Is your question regarding a regex for this specific log event? If so, this one should do it:

| rex "DEBUG alive\?=(?<alive>\S+)\s+native\?=(?<native>\S+)\s+vision\?(?<vision>\S+)"

Re: Capturing specific string from log using regex

freephoneid — Sun, 02 Oct 2011 19:49:45 GMT

When do we use rex field=_raw ??...You didn't use it here...Just wondering...

Re: Capturing specific string from log using regex

Ayn — Mon, 28 Sep 2020 09:56:16 GMT

field=_raw is used implicitly unless you specify anything else. Sometimes you might want to use another field for rex to operate on, but most commonly you'll extract fields from the raw event data. field=_raw can be used to show more explicitly that you're operating on the raw field, but really there is no functional reason for including it.