Can you help me with the following regex please?

[jip31]

hi

I want to add a rex field in my search

index=windows sourcetype="wineventlog:system" SourceName="Disk" count="$process$"
  | dedup _time
| table _time host Type EventCode

There are 2 conditions for my rex field :

Une erreur a été détectée sur le périphérique \Device\Harddisk1\DR1 lors d'une opération de pagination.

\Harddisk\ has to finish by 0 or 1, but not by another number.

After \Harddisk0\ or \Harddisk1\ it's mandatory to have DR

Could you help me please??

[harsmarvania57]

Hi @jip31,

Please try below search, replace <FieldName> with actual field name.

 index=windows sourcetype="wineventlog:system" SourceName="Disk" count="$process$"
| dedup _time
| rex field=<FieldName> "\x5C\w+\x5C(?<extracted_disk>Harddisk(?:0|1))\x5CDR"
| where isnotnull(extracted_disk)
| table _time host Type EventCode extracted_disk

If you do not want extract Harddisk0 OR Harddisk1 in another field and only want to filter result based on those Harddisk value then use regex command.

 index=windows sourcetype="wineventlog:system" SourceName="Disk" count="$process$"
| dedup _time
| regex <FieldName>="\x5C\w+\x5C(Harddisk(?:0|1))\x5CDR"
| table _time host Type EventCode

[FrankVl · Accepted solution]

Try this if you want to use the regex command to search for events that match those conditions:
| regex "\\Harddisk[0-1]\\DR"
https://regex101.com/r/F6AExN/1

Try this if you want to use the rex command to extract the harddiskname (only those matching your conditions):
| rex "\\(?<diskName>Harddisk[0-1])\\DR"
https://regex101.com/r/F6AExN/2