Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Capturing specific string from log using regex
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I've below log lines in below format:
[2011-09-30 23:33:20:465 GMT+00:00][F3951B38F4DF45440927EDF522D5C9FF.http-8080-3][com.abc.xyz.MyWrapper] DEBUG alive?=false native?=true vision?true
How can I get the values of alive, native & vision variables? Please note that after vision?, there is no "=" sign. Log is not consistent. I also want to count how many of them are with alive &whats the count for native & vision...
Appreciate your help!
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is your question regarding a regex for this specific log event? If so, this one should do it:
| rex "DEBUG alive\?=(?<alive>\S+)\s+native\?=(?<native>\S+)\s+vision\?(?<vision>\S+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is your question regarding a regex for this specific log event? If so, this one should do it:
| rex "DEBUG alive\?=(?<alive>\S+)\s+native\?=(?<native>\S+)\s+vision\?(?<vision>\S+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
field=_raw is used implicitly unless you specify anything else. Sometimes you might want to use another field for rex to operate on, but most commonly you'll extract fields from the raw event data. field=_raw can be used to show more explicitly that you're operating on the raw field, but really there is no functional reason for including it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When do we use rex field=_raw ??...You didn't use it here...Just wondering...
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
