Problem with Splunk for Nagios

[babs101]

How do I join 2 &3 generated pattern regex to replace the nagios-host Down notifications-Last

60 minutes in number 1 to display all hosts and why is number 1 above expression not working in

the splunk for nagios default state.

This is the parameter for nagios-host Down notifications-Last 60 minutes

1. index=nagios nagiosevent="HOST NOTIFICATION" hostnotificationstatus="DOWN" | dedup hostnotificationstatus hostnotification | top hostnotificationstatus by hostnotification limit="10" | fields + hostnotification hostnotificationstatus count

However this does not work I have tries to troubleshot this by checking each of the regx parameters

The nagios EXTRACT-hostnotificationstatus regular expression I copied and generate patters as follows

1. index=nagios sourcetype="nagiosevent" | head 10000 | rex ".+HOST NOTIFICATION\:[^;]+;[^;]+;(?P[^;]*)(?=;)" | top 50 hostnotificationstatus

and
For the nagios EXTRACT-hostnotification regex is as follows

1. index=nagios sourcetype="nagiosevent" | head 10000 | rex ".+\w NOTIFICATION\:[^;]+;(?P[^;]*)(?=;)" | top 50 hostnotification

Note:
Sourcetype= nagiosevent
index= nagios

[babs101 · Accepted solution]

Just in the case that anyone is out there in my predicament, This is what I have done that seems to make it work. Although I am not sure if I am correct, please not I am very new to splunk, splunk for nagios and limited knowledge with regex please do not slam me.

I have got this expression which I have just tested against my dater that works but I do not want it to be limited any input will highly appreciated.

index=nagios sourcetype="nagiosevent" | head 10000 | rex ".+HOST NOTIFICATION:[^;]+;[^;]+;(?P[^;])(?=;)" | rex ".+\w NOTIFICATION:[^;]+;(?P[^;])(?=;)" | top 1000 hostnotification hostnotificationstatus

So I went to modify the saved saved search by going to manager / searched & report and copy my generated pattern reges and paste.