appPool name not showing if it has a space in it

[stuconz]

Hi,
I am new to Splunk and I am setting up a dashboard to show when an application pool was last recycled and why. Most of the app pools I am querying have a space in the name (eg, "Process Tracking Service"), so when the query completes, it only shows app pools without a space in the name (eg, "Enrolment").

My query is below:
SourceName="Microsoft-Windows-WAS" host="server" | search recycle | rex field=Message "application pool '(?\S*)'" | eval host=upper(host) | eval reason=case(EventCode=5074, "Worker process reached processing time limit", EventCode=5075, "Worker process reached processing request limit", EventCode=5076, "Scheduled recycle", EventCode=5077, "Worker process reached processing virtual memory limit", EventCode=5079, "Manual recycle", EventCode=5080, "Config changes forced recycle", EventCode=5186, "Worker process was shut down due to inactivity") | rename appPool as "App Pool" | table _time host "App Pool" EventCode reason Message | sort by host

[chrisyounger · Accepted solution]

Try this:

SourceName="Microsoft-Windows-WAS" host="server" | search recycle | rex field=Message "application pool '(?<appPool>[^']*)'" | eval host=upper(host) | eval reason=case(EventCode=5074, "Worker process reached processing time limit", EventCode=5075, "Worker process reached processing request limit", EventCode=5076, "Scheduled recycle", EventCode=5077, "Worker process reached processing virtual memory limit", EventCode=5079, "Manual recycle", EventCode=5080, "Config changes forced recycle", EventCode=5186, "Worker process was shut down due to inactivity") | rename appPool as "App Pool" | table _time host "App Pool" EventCode reason Message | sort by host

All the best

[stuconz]

perfect. thanks for that