Dashboards & Visualizations

Need help with a Rex command

Mrig342
Contributor

Hi,

I am trying to extract "Sync_State" from the below logs types:

log1:  Synchronization : In Sync

log2: Synchronization : Out of Sync

I created the rex command "(?ms)Synchronization\s:\s(?<Sync_State>\w+\s\w+)". Using this I am getting "In Sync" in the right way but for "Out of Sync" I am getting only "Out of". 

Please help me create a rex command to extract the field values in the desired way.

 

Thank you.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OK either just remove the $ or add State to the end

rex "(?ms)Synchronization\s:\s(?<Sync_State>[\w\s]+Sync)\sState"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?ms)Synchronization\s:\s(?<Sync_State>[\w\s]+Sync$)"

Although, without the complete log entry, it may be that $ is inappropriate and something else would be better suited to denote the end of the value

0 Karma

Mrig342
Contributor

Hi ITWhisperer,

Thank you for your response. However it didn't work for me.

If you want to check the complete log entry then please find it below:

log1: Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Not running Synchronization : In Sync State : Stopped Number of template version : 6

log2: Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Running Synchronization : Out of Sync State : Stopped Number of template version : 6

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK either just remove the $ or add State to the end

rex "(?ms)Synchronization\s:\s(?<Sync_State>[\w\s]+Sync)\sState"

Mrig342
Contributor

Thank you very much ITWhisperer.. It worked. Your support is much much appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...