Multiple REX from single search

MasterOogway — Mon, 30 Jul 2012 18:24:48 GMT

I have some sendmail logs that send the following different entries within the data streams:

disposition=abc123

disposition=abc123, followed by some stuff.

disposition=xyz-123

disposition=xyz-123, followed by some stuff.

And I need to build one REX statement that allows me to call what comes after the "=" sign an errorcode. How can define multiple REX's from one search string?

Here is an example that works, but also pulls too much information after location the errorcode.

index=sendmail | rex "disposition=(?.*?)$" < ---sorry, the editor won't define my angle bracket, word, angle bracket that is between the first ? and the second?

It pulls everything after the errorcode including addtional characters, words and numbers and I need to grab strong text only.

Any thoughts on how to build a multi REX statement within one search query and defining each found errorcode as an incident?

Re: Multiple REX from single search

richgalloway — Mon, 30 Jul 2012 18:56:43 GMT

Perhaps something like "disposition=(?P[^\n,]*),?" will help.

topic Re: Multiple REX from single search in Splunk Search

Multiple REX from single search

Re: Multiple REX from single search