How do I join 2 &3 generated pattern regex to replace the nagios-host Down notifications-Last
60 minutes in number 1 to display all hosts and why is number 1 above expression not working in
the splunk for nagios default state.
This is the parameter for nagios-host Down notifications-Last 60 minutes
However this does not work I have tries to troubleshot this by checking each of the regx parameters
The nagios EXTRACT-hostnotificationstatus regular expression I copied and generate patters as follows
and
For the nagios EXTRACT-hostnotification regex is as follows
Note:
Sourcetype= nagiosevent
index= nagios
Just in the case that anyone is out there in my predicament, This is what I have done that seems to make it work. Although I am not sure if I am correct, please not I am very new to splunk, splunk for nagios and limited knowledge with regex please do not slam me.
I have got this expression which I have just tested against my dater that works but I do not want it to be limited any input will highly appreciated.
index=nagios sourcetype="nagiosevent" | head 10000 | rex ".+HOST NOTIFICATION:[^;]+;[^;]+;(?P
So I went to modify the saved saved search by going to manager / searched & report and copy my generated pattern reges and paste.
Just in the case that anyone is out there in my predicament, This is what I have done that seems to make it work. Although I am not sure if I am correct, please not I am very new to splunk, splunk for nagios and limited knowledge with regex please do not slam me.
I have got this expression which I have just tested against my dater that works but I do not want it to be limited any input will highly appreciated.
index=nagios sourcetype="nagiosevent" | head 10000 | rex ".+HOST NOTIFICATION:[^;]+;[^;]+;(?P
So I went to modify the saved saved search by going to manager / searched & report and copy my generated pattern reges and paste.