- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Regexing multiple values
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Regexing multiple values
Hello everyone,
I've been banging my head on this one. I'm sure it involves 'rex' which I'm not so familiar with.
I have the following search
search | regex _raw="|MAX TCP Connections||MAX UDP Connections|" | table _raw
Of course this spits out the entire _raw event. I'd like search for all events that match event with either MAX TCP Connection or MAX UDP Connection and send those to a field and when I use table, I see either MAX TCP Connections or MAX UDP Connections in the field. No event will have both. I really hope that makes sense. Any help would be great.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please provide some sample data and expected final output.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
"MAX TCP Connections" OR "MAX UDP Connections" | rex "(?<value>(MAX TCP Connections|MAX UDP Connections)" | stats count by value
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the reply! but this didn't work for me. 😞
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The match is case sensitive so edit as needed to exact match the string you are looking for.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maybe add a max_match=0 to the regex or to make it case insensitive add (?i) to the regex like this rex "(?<value>(?i)(MAX TCP Connections|MAX UDP Connections)" and remember - this is un-tested since I have no Splunk instance handy right now 😉
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
