Splunk Enterprise

Rex field

Azwaliyana
Path Finder

I want to extract the Country and the Node. When I use the rex in regex101, it works fine. But when I put it on Splunk search, it did not extract the Country and the Node. Do you guys know where is my mistake?

fortinet.PNG

This is my search query.

 

 

index="maxis_csaroam_index" source="/home/csaops/csaroam/*_MOS.csv" 
| dedup Description
| table Description
| rex field=Description "(?<Country>[\w]+)(?<Node>[\w\- ]*\n)"

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try without the newline in the match

| rex field=Description "(?<Country>[\w]+)(?<Node>[\w\- ]+)"

View solution in original post

somesoni2
Revered Legend

Give this a try (avoided using dedup command as well, best practice)

index="maxis_csaroam_index" source="/home/csaops/csaroam/*_MOS.csv" 
| stats count by Description
| table Description
| rex field=Description "(?<Country>\S+)\s+(?<Node>\S+)"
0 Karma

bhargavi
Path Finder

Hi @Azwaliyana ,

Try this.

| rex field=Description "(?<Country>\w+)\s(?<Node>\w*\-?\w+)"

 

bhargavi_0-1636995231697.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try without the newline in the match

| rex field=Description "(?<Country>[\w]+)(?<Node>[\w\- ]+)"
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...