topic Re: Help on construct rex expression in Splunk Search

Help on construct rex expression

mariaerh — Wed, 30 Oct 2013 22:08:45 GMT

Hello All,

From a search in Splunk I get this output from the _raw field:

(I have modified a bit the output for privace)

_raw
Oct 27 18:03:25 index-name-here postfix/smtp[xxxx]: 00000000000: to=xxx@xxx.com, relay=xxx.com[x.x.x.x]:xx, delay=0.00, delays=0.00/0.00/0.0/0.00, dsn=0.0.0, status=bounced (host xxx.com[x.x.x.x] said: 550 No Such User Here" (in reply to RCPT TO command))

I need to extract this info from the raw data:
status=bounced (host xxx.com[x.x.x.x] said: 550 No Such User Here" (some-text-here))

How can I do that using a rex expression on the search?

Thank you!

Re: Help on construct rex expression

lukejadamec — Wed, 30 Oct 2013 22:16:48 GMT

What after status=bounced does the rex need to consider?

Re: Help on construct rex expression

kristian_kolb — Wed, 30 Oct 2013 23:21:28 GMT

just what do you want to have? all in one field;

...| rex "(?<my_long_field>status=.*)$"

or do you want several smaller pieces?

Re: Help on construct rex expression

mariaerh — Thu, 31 Oct 2013 15:44:22 GMT

Hello 😃

After status I need to consider the whole value:

status=bounced (host xxx.com[x.x.x.x] said: 550 No Such User Here" (in reply to RCPT TO command))

Can I have this in 1 field?

Thank you!

Re: Help on construct rex expression

adylent — Thu, 31 Oct 2013 15:46:00 GMT

You can grab from status to the end of the line like this:

rex "status\=(?<Status>.*)"

OR just the single word like this:

rex "status\=(?<Status>\w)"

Re: Help on construct rex expression

kristian_kolb — Thu, 31 Oct 2013 15:47:22 GMT

didn't the rex above work?

Re: Help on construct rex expression

mariaerh — Thu, 31 Oct 2013 15:57:39 GMT

Thanks all for the answers, I will try and let you know.

One last question, don't I have to include this "field=_raw" right after the command rex ?

Re: Help on construct rex expression

kristian_kolb — Thu, 31 Oct 2013 15:59:18 GMT

no, that's default behaviour. no need to specify.