topic Re: Help with regex to Extract HTTP reponse codes in Splunk Search

Help with regex to Extract HTTP reponse codes

vrmandadi — Tue, 29 Sep 2020 15:29:04 GMT

Hello all,

I have the below sample events

8 Aug 2017 14:45:54 [WARN ] http_srv: Total latency exceeded threshold: 0.180145 seconds (internal 0.180000 s) origin 0.140000 seconds MCHit 0 Status: **200** IP: 69.xxx.xxx.13:2062 URL:

sample event 2

18 Aug 2017 15:06:30 [WARN ] http_cli: Origin latency exceeded threshold: 0.141100 seconds GET Status: **200**[OK] Bytes: 10081 Origin URL: http://linear-scope010.com/LIVE/1007/hls/ae/MSNBC_HD/900.m3u8 refReqId 13542238 reqWait 0 (id 3289754508)

sample event 3

Aug 2017 17:58:07 [WARN ] http_srv: DONE 4199750 0.023084 **404**[Not ...

sample event 4-this does not have the http code

22 Aug 2017 15:50:27 [WARN ] Content Generator: Discontinuity Sequence mismatch adding 982 at frag 1989008, adjusting previous (id 26007997)

I want a help with regex to extract the HTTP Response codes of events which have http_srv or http_cli in the events and save them in field called HTTP_Code .
Thanks in advance

Re: Help with regex to Extract HTTP reponse codes

somesoni2 — Tue, 22 Aug 2017 16:44:47 GMT

Give this a try

your base search | rex "(http_srv|http_cli).+(?<HTTP_Code>\d{3})(\[|\sIP)"

Re: Help with regex to Extract HTTP reponse codes

gcusello — Wed, 30 Sep 2020 02:54:50 GMT

Hi vrmandadi,
I'm not able to extract HTTP_Values for all samples using only one regex, but I can do it in two regexes:
to extract HTTP_Code from samples 1, you can use the following regex

(http_srv|http_cli).*Status:\s(?<HTTP_Code1>\d+)\s

instead for the Sample 2 and 3 use this regex

(http_srv|http_cli).*\s(?<HTTP_Code2>\d+)(\[OK|\[Not)

After you can merge results using coalesce function:

| eval HTTP_Code=coalesce(HTTP_Code1,HTTP_Code2)

Bye.
Giuseppe

Re: Help with regex to Extract HTTP reponse codes

vrmandadi — Tue, 22 Aug 2017 17:24:27 GMT

Hello @somesoni2

Thanks for the somesh it worked