topic Re: I have to extract field by using rex in Splunk Search

How to extract field using rex?

lucky — Tue, 05 Sep 2023 16:59:53 GMT

I need regular expression to extract field "timed out " by using below log ....

"Description":"Job-2069950 Error in [InfrastructureServices/Dispatcher/Interface/MQ_InterfaceDispatcher.process/JMS Queue Requestor]\nActivity timed out\n\tat com.tibco.pe.core.

please help to write regular expression by using rex command ...

Re: I have to extract field by using rex

gcusello — Wed, 19 Jul 2023 06:17:08 GMT

Hi @lucky,

if "\n" is a part of your log, you can use the following regex:

| rex "Activity\s+(?<timed_out>[^\\n]+)"

that you can test at https://regex101.com/r/HZj7ZQ/1

Ciao.

Giuseppe

Re: I have to extract field by using rex

lucky — Wed, 19 Jul 2023 07:00:43 GMT

thanks ....

we need a chart showing the timeout errors per Country...

can you please help on this

Re: I have to extract field by using rex

ITWhisperer — Wed, 19 Jul 2023 07:53:07 GMT

<your search> "Activity timed out" | stats count by country

Re: I have to extract field by using rex

lucky — Wed, 19 Jul 2023 08:18:02 GMT

thanks......

I need show linechart ...

X -axis success percentage
y-axis time
with respect to country code wise

Re: I have to extract field by using rex

ITWhisperer — Wed, 19 Jul 2023 11:06:06 GMT

With the limited amount of information you have provided about your events, how you determine success and not success, what time period you want to average over, whether you have any fields already extracted, etc. it is very difficult to provide you with a meaningful answer.

The key to getting a question answered is providing as much useful and relevant information as possible as soon as possible without providing too much - you have erred on the side of providing as little as possible and in a piecemeal fashion!

Re: I have to extract field by using rex

lucky — Mon, 04 Sep 2023 05:35:56 GMT

how to down load debugrex ..command sheet

please provide link

Re: I have to extract field by using rex

bowesmana — Mon, 04 Sep 2023 06:20:59 GMT

https://regex101.com/

https://www.regexbuddy.com/

Re: I have to extract field by using rex

lucky — Mon, 04 Sep 2023 07:06:51 GMT

thanks for it....

but I need to REX not for REGEX

Re: I have to extract field by using rex

ITWhisperer — Mon, 04 Sep 2023 08:45:18 GMT

@lucky regex is short for regular expression

regex101.com and regexbuddy.com (as provided by @bowesmana ) are both sites which provide ways of testing regular expressions (regex)

In Splunk, the rex and regex commands both use regular expressions (as do other functions in Splunk). Whether you want rex or regex, both the sites mentioned are useful tools for working out what your particular regex should be.

rex - Splunk Documentation

regex - Splunk Documentation

Re: I have to extract field by using rex

lucky — Tue, 05 Sep 2023 08:22:04 GMT

please help below

message : httpStatusCode=300 method=GET uri=/ralt/gart/readyness uuid=-

need uri field

Re: I have to extract field by using rex

ITWhisperer — Tue, 05 Sep 2023 08:27:14 GMT

Try something like this

| rex "uri=(?<uri>\S+)"

Re: I have to extract field by using rex

lucky — Tue, 05 Sep 2023 08:51:43 GMT

thanks.....

please help below

message:

(loggingfilterresults) - GET|/ready/term/planess|||||||metrics

need uri field

Re: I have to extract field by using rex

ITWhisperer — Tue, 05 Sep 2023 09:00:46 GMT

Which part is the uri field?

Re: I have to extract field by using rex

lucky — Tue, 05 Sep 2023 09:02:43 GMT

/ready/term/planess

Re: I have to extract field by using rex

ITWhisperer — Tue, 05 Sep 2023 09:12:35 GMT

| rex "(?<uri>/ready/term/planess)"

Re: I have to extract field by using rex

lucky — Tue, 05 Sep 2023 09:23:54 GMT

thanks

but I have number of uri's

same pattern

Re: I have to extract field by using rex

ITWhisperer — Tue, 05 Sep 2023 10:31:41 GMT

What is the pattern? Please describe it in more detail. (Regular expressions work by finding patterns but you have to be able to precisely describe the pattern.)

Re: How to extract field using rex?

lucky — Wed, 06 Sep 2023 05:27:21 GMT

HI team ,

let me know please
how can I get cpu amd memory usage by index and API

Re: I have to extract field by using rex

gcusello — Wed, 06 Sep 2023 06:29:33 GMT

Hi @lucky ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉