Alerting

extract characters after colon

ksharany
New Member

Hi ,

My log consists of below

msg: 2018-07-07 14:30:02.226 INFO 7 --- [nio-8080-exec-6] c.f.p.a.service.CGEventRetimeService : <> : 12006

I need to extract the values after <> : i.e) 12006 alone and create alert to be sent to user .

How do I do it ?

0 Karma

PowerPacked
Builder

Hi @ksharany

Take a look at this.

alt text

Thanks

0 Karma

FrankVl
Ultra Champion

Two options:

  1. use the characters in front of it as demarkation point: | rex "\<\>\s+:\s+(?<field1>\d+)" https://regex101.com/r/0na0Fq/1
  2. if it is really at the end of the event and you don't have other (similar) logs that cause issues, you can grab if from the end of the string: | rex "(?<field1>\d+)$" https://regex101.com/r/0na0Fq/2

Note that second option is a simpler regex, but less efficient.

0 Karma

jodyfsu
Path Finder

This should work:

| rex "\<\>\s\:\s(?<NUMBERS>\d+)"

Let us know if you need more help.

0 Karma

ksharany
New Member

To be more precise - i need to search for msg with " Invalid Retimed Control Group " text and extract the highlighted felds

msg: 2018-07-07 14:30:02.226 INFO 7 --- [nio-8080-exec-6] c.f.p.a.service.CGEventRetimeService : < Invalid Retimed Control Group > : CCF 2018 12006

and display the highlighted bold once as separate columns in CSV file as below

Date - 2018-07-07
Time - 14:30:02
PTVL - CCF
MY - 2018
CG - 12006

0 Karma

jodyfsu
Path Finder

give this a shot:

| rex "^msg\:\s(?<DATE>.[^\s]+)\s(?<TIME>.[^\s]+).[^\:]+\:.[^\:]+\:\s(?<PTVL>.[^\s]+)\s(?<MY>.[^\s]+)\s(?<CG>.[^\s]+)"
0 Karma

jodyfsu
Path Finder

You will want to do
| table DATE TIME PTVL MY CG

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...