Regx

Siddharthnegi — Thu, 19 Sep 2024 09:17:46 GMT

Hi I want to extract the highlighted part

RAISE-ALARM:acIpGroupNoRouteAlarm: [KOREASBC1] IP Group is temporarily blocked. IP Group (IPG_ITSP) Blocked Reason: No Working Proxy; Severity:major; Source:Board#1/IPGroup#2;
local0.warning [S=2952580] [BID=d57afa:30] RAISE-ALARM:acIpGroupNoRouteAlarm: [KOREASBC1] IP Group is temporarily blocked. IP Group (IPG_ITSP) Blocked Reason: No Working Proxy; Severity:major; Source:Board#1/IPGroup#2; Unique ID:209; Additional Info1:; [Time:29-08@17:53:05.656]

17:53:05.655 10.82.10.245 local0.warning [S=2952579] [BID=d57afa:30] RAISE-ALARM:acProxyConnectionLost: [KOREASBC1] Proxy Set Alarm Proxy Set 1 (PS_ITSP): Proxy lost. looking for another proxy; Severity:major; Source:Board#1/ProxyConnection#1; Unique ID:208; Additional Info1:; [Time:29-08@17:53:05.655]

Re: Regx

ITWhisperer — Thu, 19 Sep 2024 09:25:55 GMT

| rex max_match=0 "\[KOREASBC1\](?<message>[^;]+)"

Re: Regx

Jawahir — Thu, 19 Sep 2024 11:57:24 GMT

|rex "\[KOREASBC1\]\s(?<field_name>[^;]+)"

topic Re: Regx in Splunk Search

Regx

Re: Regx

Re: Regx