Getting Data In

Help in RegEx to get a separate values

jerinvarghese
Communicator

Need help in formatting a regex comand output.

Program that I created:

index=opennms  "bigipServiceDown"
  | rex field=eventlogmsg "bigipNotifyObjMsg=(?<POOL>.+down. )"
  | table POOL, nodelabel

Output :

POOL    nodelabel
Pool /Common/tiger.exxonmobil.com-443-pl member /Common/10.159.217.11:443 monitor status down. [ /Common/https-vdi-connection_manager: down;    INMCOIGW-APNADC003
Pool /Common/tiger.exxonmobil.com-443-pl member /Common/10.159.217.11:443 monitor status down. [ /Common/https-vdi-connection_manager: down;    INMCOIGW-APNADC003
Pool /Common/tiger.exxonmobil.com-443-pl member /Common/10.159.217.11:443 monitor status down. [ /Common/https-vdi-connection_manager: down;    INMCOIGW-APNADC003

Expected output :

POOL    Monitor VDI nodelabel
tiger.exxonmobil.com-443-pl member  10.159.217.11:443 monitor status down   Common/https-vdi-connection_manager: down   INMCOIGW-APNADC003
leopard.exxonmobil.com-443-pl member    Common/vdi-pnh.ap.xom.com:443 monitor status down   Common/https-vdi-connection_manager-pnh: down   INMCO-APNADC104

RAW Data :

eventlogmsg=""<p>
    bigipServiceDown trap received
    bigipNotifyObjMsg=Pool /Common/leopard.exxonmobil.com-443-pl member /Common/vdi-pnh.ap.xom.com:443 monitor status down. [ /Common/https-vdi-connection_manager-pnh: down; last error: /Common/https-vdi-connection_manager-pnh:  Response Code: 404 (Not Found) @2020/02/03 07:06:46.  ]  [ was up for 0hr:49mins:15sec ] (slot2)
    bigipNotifyObjNode=/Common/vdi-pnh.ap.xom.com
    bigipNotifyObjPort=443</p>""
0 Karma

jbrocks
Communicator

You can use the following regex to extract the 3 fields POOL, Monitor and VDI. You can try this regex in regex101 to check what exactly is happening:

"bigipNotifyObjMsg=Pool\s+.*?(?<POOL>[^\/]+)(?=\s+)\s+.*?(?<Monitor>[^\/]+)(?=\.\s+\[)\.\s+\[\s+(?<VDI>[^;]+);"
0 Karma

jerinvarghese
Communicator

Sorry that didnt worked, its not giving a result.

Raw Data:

eventlogmsg=""


bigipServiceDown trap received
bigipNotifyObjMsg=Pool /Common/leopard.exxonmobil.com-443-pl member /Common/vdi-pnh.ap.xom.com:443 monitor status down. [ /Common/https-vdi-connection_manager-pnh: down; last error: /Common/https-vdi-connection_manager-pnh: Response Code: 404 (Not Found) @2020/02/03 07:06:46. ] was up for 0hr:49mins:15sec
bigipNotifyObjNode=/Common/vdi-pnh.ap.xom.com
bigipNotifyObjPort=443

""

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...