topic Re: Need help with syntax and rex in Splunk Search

Need help with syntax and rex

LizAndy123 — Fri, 11 Oct 2024 15:32:26 GMT

I have a log with a sample of the following

POST Uploaded File Size for project id : 123 and metadata id : xxxxxxxxxxxx is : 1234 and time taken to upload is: 51ms

So this is project id : 123

Size is 1234

Upload Speed is 51ms

I what to extract the project id , size and the upload time as fields

also regarding the upload time I guess I just need the number right.

gcusello — Fri, 11 Oct 2024 16:02:14 GMT

please try this:

| rex "project id : (?<Project_Id>\d+) and metadata id : \w+\sis\s:\s(?<Size>\d+) and time taken to upload is: (?<Upload_Speed>\w+)"

that you can test at project id : (?<Project_Id>\d+) and metadata id : \w+\sis\s:\s(?<Size>\d+) and time taken to upload is: (?<Upload_Speed>\w+)

Ciao.

Giuseppe

Jawahir — Sat, 12 Oct 2024 10:45:03 GMT

Try this :

|rex "project\sid[\s\:]+(?<project_id>[^\s]+).+?is[\s\:]+(?<size>[^\s]+).+?is[\s\:]+(?<upload_time_ms>\d+)"

LizAndy123 — Mon, 21 Oct 2024 10:45:37 GMT

Thanks both of you - both work :-0)