I have a csv file that I am trying to pull data from, this is an example of the data in the file:
Action, Message, Server Connection, Service Path, Service Acct, Source IP, Time, User
Retrieve password,126.259.193.138,(Action: Connect)(Connection to address: aservername01),Operating System-FHR-ServerAdmins-kochind.com-SVC_SVRACCESS_PROD_5,SVC_SVRACCESS_PROD_5,172.16.125.36,07/10/2018 15:45:41,Some.Guy@nowhere.com
My query where I am trying to pull just the server name, "aservername01" out of the file:
| inputlookup filename.csv
| rex field=_raw "address: (?<Server>.*)"
It is not returning the "Server" field with any data. Is this because it is a csv file instead of a text file? What am I missing because I'm not getting any errors from Splunk.
Thank you!
Hi batsonpm,
when using inputlookup
you will not get a field called _raw
, try using the header name for this column:
| rex field="Server Connection" "address: (?<Server>[^)]+)"
Also note the changed regex, since your would match everything after address:
.
Hope this helps ...
cheers, MuS
Hi batsonpm,
when using inputlookup
you will not get a field called _raw
, try using the header name for this column:
| rex field="Server Connection" "address: (?<Server>[^)]+)"
Also note the changed regex, since your would match everything after address:
.
Hope this helps ...
cheers, MuS
Gah! I was so close! 🙂
I couldn't find any docs on how to explicitly use the ')' for rex since it was '[^)]' in regex, so I left it off to just get thru the first issue of actually getting data.
Thank you!