topic Re: regex for event type. in Splunk Search

regex for event type.

brettcave — Tue, 20 Nov 2012 08:06:38 GMT

Hi, is it not possible to use a regex to determine an event type. I would like to usee something like:

\d{4}-\d{1,2}-\d{1,2}T\d{2}:\d{2}:\d{2}.\d{3}. \| [A-Z]+ \|

to classify events.

Re: regex for event type.

martin_mueller — Tue, 20 Nov 2012 08:13:55 GMT

You can create an event type based on a search. In that search, use the regex command to match against your expression.

Re: regex for event type.

brettcave — Tue, 20 Nov 2012 08:22:09 GMT

How do you use a regex command?

| regex _raw="(my regex)"

Message: Eventtype search string cannot be a search pipeline or contain a subsearch

Doesn't work.

Re: regex for event type.

martin_mueller — Tue, 20 Nov 2012 09:13:22 GMT

Bummer on the pipes. You can still use the regular expression, just go the long way by defining a field on that match, and create an eventtype based on that_field=*.

Re: regex for event type.

Rob — Tue, 20 Nov 2012 19:05:13 GMT

It might be more informative if you can show us a more complete example. Such as the search with the entire regex.

The 'regex' command in splunk is used to filter events. If you want to extract fields, use the 'rex' command.

Re: regex for event type.

brettcave — Wed, 21 Nov 2012 06:54:58 GMT

well I can't use any pipe command with event types, so it wouldn't work with | rex ... either. I have events that are generated from 2 sources, and want to use the format of the sources as event type identifiers, so for example, source 1 formats as follows:

2012-11-21T06:50:19.721Z | INFO | some message

and source 2 formats as follows:

Nov 20 23:26:43 localhost Nov 20 23:26:43 ip-10-0-3-148 INFO | com.my.logger | thread

Re: regex for event type.

brettcave — Wed, 21 Nov 2012 06:55:03 GMT

Both events are a sort of log4j / syslog custom brew, but with slightly different syntaxes, so the most effective way of categorizing them would be by rex.

martin_mueller's suggestion of creating a field extractor based on the rex is a great suggestion, and would work well for this situation.

Re: regex for event type.

brettcave — Wed, 21 Nov 2012 06:55:29 GMT

that is a great suggestion, and will work well. Thanks martin.