Dashboards & Visualizations

How to extract fields from the logs

mariamathewtel
Explorer

Hi All,

I am having a set of logs from one of my ticketing system.  I want to extract the Host name of the device that caused issue from the description. 

Critical_DISK: ABC - /var is at 99 % .
Critical_DISK: DEF - /var/log is at 85 % .
Critical_DISK: GHI - /var/log is at 90 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 73 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 85 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 87 % .
Critical_DISK: hkgtelpac-sg1.hkg2.oss - /var/log is at 85 % .
[VMware vCenter - Alarm alarm.HostConnectivityAlarm] Host abcdefgh.in.reach.com in TGCN_PAD is not responding
[zenoss] AB-CD-EFG 10.111.122.33 is DOWN!
[zenoss] QWERTYU disk space threshold: 98.1% used (8.1GB free)
[zenoss] asedfrt 10.20.30.40 is DOWN!

 

These are some sample description. 

I used this rex statement : | rex field=_raw "^[^\\]\\n]*\\]\\s+(?P<HostName>\\w+)" 
but it is not properly extracting the hostname. 

Can someone please help me with this. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this rex command.

 

| rex "[:\]]\s(?:Host\s)?(?<HostName>\S+)"

 

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Which part of those events (I assume they're separate events) is the host name?  I see at least 3 different ways to identify the host.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mariamathewtel
Explorer

Hi @richgalloway ,

Thanks for the reply. Host names are the highlighted bold ones. 

Critical_DISK: ABC - /var is at 99 % .

Critical_DISK: DEF - /var/log is at 85 % .
Critical_DISK: GHI - /var/log is at 90 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 73 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 85 % .
Critical_DISK: JKL-MNO-PQR - /var/log is at 87 % .
Critical_DISK: hkgtelpac-sg1.hkg2.oss - /var/log is at 85 % .
[VMware vCenter - Alarm alarm.HostConnectivityAlarm] Host abcdefgh.in.reach.com in TGCN_PAD is not responding
[zenoss] AB-CD-EFG 10.111.122.33 is DOWN!
[zenoss] QWERTYU disk space threshold: 98.1% used (8.1GB free)
[zenoss] asedfrt 10.20.30.40 is DOWN!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...