Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Field Extraction and search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is the line in the log I am working with;
Message=COMPUTERNAME [Monday, April 02, 2018 7:15:53 AM (GMT-06:00)]: Status of device 'COMPUTER' changed to Critical: Many viruses detected.
Goal;
I would like to search my database for all logs that have the status "Many viruses detected"
I am newer to splunk, I need to use rex correct? I do not think the field has been extracted yet.
After being able to find all the computers with this log, I would like to extract the field for future use.
My search;
index=my_index | rex field=_raw"(?)Message=(?[a-zA-z0-9:\s[]\-,=`'."]\sMany\sviruses\sdetected"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To return events with a specific string, just include that string in your base search.
index=my_index "Many viruses detected"
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you wanted to extract the computer name, message and status you could try something like this:
rex field=_raw "Status of device '(?<COMPUTERNAME>.*?)' (?<MESSAGE>.*?): (?<STATUS>.*?)\."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To return events with a specific string, just include that string in your base search.
index=my_index "Many viruses detected"
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My search IS NOT working
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What value you want to capture from the above event using REX ?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Unlocking Unified Insights: New Gigamon Federated Search App for Splunk
GA: New Data Management App in Splunk Platform
Announcing Modern Navigation: A New Era of Splunk User Experience
