How to Combine Two Regex to Form One Variable

jepoyyyy — Tue, 29 Sep 2020 11:21:05 GMT

Hi all,

I have events similar to these:

[10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000001
[10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000001
[10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000002
[10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000002

My objective is to extract TrxThread and subsNumber (ex. 1000000001) and combine them into one variable so that I could differentiate each transaction even though they have the same TrxThread

My end goal is to measure the duration so I'll be using the search below once I get the combined transaction thread and subs number
| stats earliest(_time) as start latest(_time) as end by combined_trx_id | eval dur=end-start

Thanks in advance!

Kindest regards,
Jeff

Re: How to Combine Two Regex to Form One Variable

sundareshr — Mon, 10 Oct 2016 12:19:30 GMT

Try like this

.... | rex "Thread\((?<tid>\w+).*for\s(?<id>\d+)$" | eval combined_trx_id=tid."::".id

Re: How to Combine Two Regex to Form One Variable

jepoyyyy — Tue, 11 Oct 2016 02:40:36 GMT

it worked perfectly. Thanks a lot sir!

topic Re: How to Combine Two Regex to Form One Variable in Splunk Search

How to Combine Two Regex to Form One Variable

Re: How to Combine Two Regex to Form One Variable

Re: How to Combine Two Regex to Form One Variable