Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Getting Data In
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Regex help
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SS1
Path Finder
03-22-2021
10:46 PM
Hi,
I have the below event where i tried to extract field ServerA
Event:
ADMU0509I: The Application Server "serverA" cannot be reached. It appears to be stopped.
Query: source="teststatus"| rex max_match=100 field=_raw "Server\s"(?P<jvm>.*)"\s*cannot\sbe\s(?P<status>.*)"|table jvm,host
Output is showing as "serverA" instead of serverA. I dont want the double quotes, how do i achieve that?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
493669
Super Champion
03-22-2021
11:04 PM
@SS1
You can use backslash before quotes to consider in regex like below-
source="teststatus"| rex max_match=100 field=_raw "Server\s\"(?P<jvm>.*)\"\s*cannot\sbe\s(?P<status>.*)"|table jvm,host
If this helps an upvaote will be appreciated!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SS1
Path Finder
03-22-2021
11:23 PM
Thanks. This solution worked
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
493669
Super Champion
03-22-2021
11:04 PM
@SS1
You can use backslash before quotes to consider in regex like below-
source="teststatus"| rex max_match=100 field=_raw "Server\s\"(?P<jvm>.*)\"\s*cannot\sbe\s(?P<status>.*)"|table jvm,host
If this helps an upvaote will be appreciated!
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!
Tech Talk Recap | Mastering Threat Hunting
Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...
Observability for AI Applications: Troubleshooting Latency
If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...
