Dashboards & Visualizations

Why am I unable to get the exact rex output?

Nagalakshmi
Explorer

Hi Team,

We are trying to extract the hostname from the logs . but unable to get the exact output ( we need hostname as sample-987) . Please find the logs and tried command. Please assist us on high priority. Thanks

logs:-
 Symptom: type DD Alert Sample-987: CRITICAL: DiskFailure: HardwareFailure

Our Command:-
| rex field=_raw "DD\s\Alert\s(?<HostName>\w+-\d+)"


Regards,
Lakshmi 

Labels (2)
Tags (2)
0 Karma
1 Solution

Nagalakshmi
Explorer

Hi @isoutamo ,

Thank you for your help! We got the expected output by using the below mentioned command.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You don't need the backslash before the A (\A asserts position at start of the string)

isoutamo
SplunkTrust
SplunkTrust

Hi

can you try this

 

| rex "DD Alert (?<HostName>[^:]+)"

 

r. Ismo

fixed: removed unnecessary escape characters.

Nagalakshmi
Explorer

Hi @isoutamo ,

Thank you for your help! We got the expected output by using the below mentioned command.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...