Dashboards & Visualizations

Regex Help

alan20854
Path Finder

Hello,

I am trying to create a table on my dashboard with the time stamp and the buildID. However, I am having regex trouble with my search.

Here is the search without the field extraction: host= x source= x "PDD_BUILDID". These events contain the buildID in a format such as [BUILDID=APP-2016.8-20160712194753]

This is my current search:

host= x source= x  "PDD_BUILDID"|rex field=_raw "BUILDID=(?P<build>\w*\d*\w*\d*\w*\d*)\x5D" | table build

I would like my table to contain the time and buildIDs such as APP-2016.8-20160712194753.

What am I doing wrong?

0 Karma
1 Solution

sundareshr
Legend

Try this

 host= x source= x  "PDD_BUILDID"|rex field=_raw "BUILDID=(?P<build>[^\]]+)" | table build

View solution in original post

somesoni2
Revered Legend

Try like this

 host= x source= x  "PDD_BUILDID"|rex field=_raw "BUILDID=(?P<build>[^-]+-[^-]+)-(?<time>\d+)" | table build time | rex mode=sed field=time "s/(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})/\1-\2-\3- \4:\5:\6/g" 

sundareshr
Legend

Try this

 host= x source= x  "PDD_BUILDID"|rex field=_raw "BUILDID=(?P<build>[^\]]+)" | table build
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...