Rex not iterating over large string

evan_roggenkamp — Wed, 07 Sep 2016 21:45:28 GMT

I am trying to use rex to extract the hostnames and put them in a table, but rex is only matching the first string and then it stops

rex "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name

The data is part of a job log I am ingesting files and directories input.

The textfile is formatted like this:

___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.mrcl1.domain.net (10.140.255.7):
 ERROR: Cannot download Running config : Connection Refused by 10.140.255.7
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.abvl1.domain.net (10.252.255.50):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.blvw1.domain.net (10.196.255.5):
downloaded Running config
__________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.clem1.domain.net (10.196.255.1):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.domain.net (10.140.255.9):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.drck1.domain.net (10.132.255.3):
downloaded Running config
___________________________________________________________________________

I did have to clean this file up with python before getting it into splunk, so if some kind of text operation/reorganization would help this go more smoothly that is definitely an option.

Re: Rex not iterating over large string

somesoni2 — Wed, 07 Sep 2016 21:47:51 GMT

The rex command by default matches only one. Use max_matchoption to increase that limit

 ...| rex max_match=100 "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name

Re: Rex not iterating over large string

gcusello — Thu, 08 Sep 2016 11:33:43 GMT

try this

HOSTNAME:\s+(?<myfield>[^ ]+)/g

you can test it on https://regex101.com/
Bye.
Giuseppe

topic Re: Rex not iterating over large string in Splunk Search

Rex not iterating over large string

Re: Rex not iterating over large string

Re: Rex not iterating over large string