Hey There,
i have n Systems.
I would like to apply a rex query, where each fieldname contains the system ID which i have to extract from the logs too.
Example:
... | rex field=_raw "System(\d+)\sFailure\sRate\s(?<system_\1_failurerate>\d*)"
Unfortunately backreferencing for field name seems not to be supported.
Has anyone an idea? It needs to be added in a TA afterwards, hence eval etc. are not applicable
Thanks 🙂
How about modifying the text into xml and extracting the fields that way
| makeresults
| eval _raw="SystemR1 Failure Rate 17
System2 Failure Rate 3"
| rex mode=sed "s/(?<system>System.+\sFailure\sRate) (?<rate>\d+)/<\1>\2<\/\1>/g s/\s+/_/g"
| spath
It works but i forgot to mention, that each log can have multiple matches. This solution will only find the first match in the logs
Perhaps if you could share an anonymised example log entry or two - please use code block </> to share it
SystemR1 Failure Rate 17
System2 Failure Rate 3
I held the whole example abstract as i can't even share anonymized data 😕
making a rex like the following one will match the first row with system R1 but ignore system 2
| rex field=_raw "System(?<id>R?\d)\sFailure\sRate\s(?<rate>\d+)
| eval system_{id}_failure = rate
using multivalues is also not possible, as this will be used as a transform in a globally available TA
How about modifying the text into xml and extracting the fields that way
| makeresults
| eval _raw="SystemR1 Failure Rate 17
System2 Failure Rate 3"
| rex mode=sed "s/(?<system>System.+\sFailure\sRate) (?<rate>\d+)/<\1>\2<\/\1>/g s/\s+/_/g"
| spath
| rex field=_raw "System(?<number>\d+)\sFailure\sRate\s(?<system_failurerate>\d*)"
| eval system_{number}_failurerate=system_failurerate