topic Re: rex usage in splunk in Splunk Search

rex usage in splunk

dutabhis07 — Tue, 18 Mar 2014 19:29:00 GMT

Hi,
i am trying to create a pie chart with gives %age up and down time of a system.
Splunk mines a log file with the below format giving the system availability stat.
If you see below, we have three status System up, down and down due to db failure.
we want to combine both the downs into single category of "Down"
Were using the below query in splunk to get the pie chart but the Down comes up in two different segment.
index=prd sourcetype="nodecheck" | rex "System (?.*)" | chart count by upordown

2014-03-17 15:53:00-SystemA System Up
2014-03-17 15:48:01-SystemA System Up
2014-03-17 15:43:00-SystemA System Up
2014-03-17 15:38:00-SystemA System Up
2014-03-17 15:33:00-SystemA System Up
2014-03-17 15:01:01-SystemA System Down
2014-03-17 15:31:00-SystemA System Down - Unable to connect to the Database!
2014-03-17 15:21:01-SystemA System Down - Unable to connect to the Database!
2014-03-17 15:11:01-SystemA System Down - Unable to connect to the Database!
2014-03-17 15:01:01-SystemA System Down - Unable to connect to the Database!
2014-03-17 14:48:00-SystemA System Up
2014-03-17 14:43:00-SystemA System Up

Re: rex usage in splunk

grijhwani — Tue, 18 Mar 2014 19:46:56 GMT

rex "System (?<upordown>) .*"

This should provide you with just the single word following "System"

To be even more flexible you could change it to

rex "System\s(?<upordown>)\s.*"

This will ensure the word breaks happen for any whitespace character not just a space itself.

Re: rex usage in splunk

somesoni2 — Tue, 18 Mar 2014 22:26:04 GMT

Try this:

index=prd sourcetype="nodecheck" | rex "System\s(?<upordown>\w+)" | chart count by upordown

Re: rex usage in splunk

chimell — Mon, 12 Dec 2016 09:13:54 GMT

Try this search code

index=prd sourcetype="nodecheck"|rex field=_raw "System\s+(?<SystemStatus>[^\$|^\!]+)"|chart count by SystemStatus