Splunk Search
Highlighted

Extracting multiple fields from a line

Engager

I have a line that contains 2 different fields that I need

Right now I have:
index=os sourcetype="xxx" | regex _raw="\d tests, \d assertions, \d failures, \d errors"

Which returns for example:
2 tests, 2 assertions, 0 failures, 0 errors

How can I extract the fields tests and failures? would it be possible?

0 Karma
Highlighted

Re: Extracting multiple fields from a line

SplunkTrust
SplunkTrust
Highlighted

Re: Extracting multiple fields from a line

Engager

can you post how we can do it with rex, I'm still struggling

0 Karma
Highlighted

Re: Extracting multiple fields from a line

Engager

the number actually comes before \d tests

0 Karma
Highlighted

Re: Extracting multiple fields from a line

SplunkTrust
SplunkTrust

I'm guessing this:

... | rex "(?<tests>\d+) tests, (?<assertions>\d+) assertions, (?<failures>\d+) failures, (?<errors>\d+) errors"

However, without seeing your actual events that's only that, a guess.

0 Karma
Highlighted

Re: Extracting multiple fields from a line

SplunkTrust
SplunkTrust

Can you post some sample logs? Based on that people will be able to help you with field extractions.

0 Karma