Dashboards & Visualizations

Need help with a Rex command

Mrig342
Contributor

Hi,

I am trying to extract "Sync_State" from the below logs types:

log1:  Synchronization : In Sync

log2: Synchronization : Out of Sync

I created the rex command "(?ms)Synchronization\s:\s(?<Sync_State>\w+\s\w+)". Using this I am getting "In Sync" in the right way but for "Out of Sync" I am getting only "Out of". 

Please help me create a rex command to extract the field values in the desired way.

 

Thank you.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OK either just remove the $ or add State to the end

rex "(?ms)Synchronization\s:\s(?<Sync_State>[\w\s]+Sync)\sState"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?ms)Synchronization\s:\s(?<Sync_State>[\w\s]+Sync$)"

Although, without the complete log entry, it may be that $ is inappropriate and something else would be better suited to denote the end of the value

0 Karma

Mrig342
Contributor

Hi ITWhisperer,

Thank you for your response. However it didn't work for me.

If you want to check the complete log entry then please find it below:

log1: Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Not running Synchronization : In Sync State : Stopped Number of template version : 6

log2: Mon Jan 25 19:07:03 EST 2021 Node Id :47337 Node State : Running Synchronization : Out of Sync State : Stopped Number of template version : 6

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK either just remove the $ or add State to the end

rex "(?ms)Synchronization\s:\s(?<Sync_State>[\w\s]+Sync)\sState"

Mrig342
Contributor

Thank you very much ITWhisperer.. It worked. Your support is much much appreciated.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...