Hi Team,
We are trying to extract the hostname from the logs . but unable to get the exact output ( we need hostname as sample-987) . Please find the logs and tried command. Please assist us on high priority. Thanks
logs:-
Symptom: type DD Alert Sample-987: CRITICAL: DiskFailure: HardwareFailure
Our Command:-
| rex field=_raw "DD\s\Alert\s(?<HostName>\w+-\d+)"
Regards,
Lakshmi
Hi @isoutamo ,
Thank you for your help! We got the expected output by using the below mentioned command.
You don't need the backslash before the A (\A asserts position at start of the string)
Hi
can you try this
| rex "DD Alert (?<HostName>[^:]+)"
r. Ismo
fixed: removed unnecessary escape characters.
Hi @isoutamo ,
Thank you for your help! We got the expected output by using the below mentioned command.