Splunk Search

Getting inconsistent extraction

srinivas_gowda
Path Finder

Hello all,

 

I am trying to extract the below highlighted fields, but the extractions at time is failing to get the required values, can you please help me get this working.

1) 537654 High 2021.11.10 10:53:50 RDS_Failure_notification01 prd-Server2 127.0.0.1 sns.event EventSource : db-instance IdentifierLink : https://console.aws.amazon.com SourceId : prd-Server2 EventId : http://docs.aws.amazon.com EventMessage : DB instance restarted TopicArn : arn:aws:sns:ap-northeast-1:123456789:Lambda-PRD-Server1-SSS


2) 536465 High 2021.11.09 23:07:33 Server just booted [prd-Server1] prd-Server1 127.0.0.1 Server Status 00:04:44


3) 536438 High 2021.11.09 23:01:02 App Proxy: Utilization of unreachable poller processes over 80% prd-Server3 127.0.0.1 Utilization of unreachable poller data collector processes, in % 100 %


4) 448232 Average 2021.11.09 09:56:02 App Proxy: Utilization of unreachable poller processes over 70% prd-Server4 127.0.0.1 Utilization of unreachable poller data collector processes, in % 100 %

 

BOLD - Field1

Underlined -Field2

Strikethrough - Field3

 

@ITWhisperer @javiergn @richgalloway  Please have a look at this.

 

Thank you

Labels (4)
0 Karma

srinivas_gowda
Path Finder

Hello, thanks for the response. But, this is not working for the highlighted fields.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In what way is it not working? Which fields are you not getting? Which events is it not working for? The more information you can give about your issue, the more likely we will be able to come up with a helpful answer!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\d+\s\w+\s(?<time>\d{4}\.\d{2}\.\d{2}\s\d{2}:\d{2}:\d{2})\s(?<field1>.+)\s(?<server>\S+)\s(?<ip>\d+\.\d+\.\d+\.\d+)"
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>