Splunk Search

Getting inconsistent extraction

srinivas_gowda
Path Finder

Hello all,

 

I am trying to extract the below highlighted fields, but the extractions at time is failing to get the required values, can you please help me get this working.

1) 537654 High 2021.11.10 10:53:50 RDS_Failure_notification01 prd-Server2 127.0.0.1 sns.event EventSource : db-instance IdentifierLink : https://console.aws.amazon.com SourceId : prd-Server2 EventId : http://docs.aws.amazon.com EventMessage : DB instance restarted TopicArn : arn:aws:sns:ap-northeast-1:123456789:Lambda-PRD-Server1-SSS


2) 536465 High 2021.11.09 23:07:33 Server just booted [prd-Server1] prd-Server1 127.0.0.1 Server Status 00:04:44


3) 536438 High 2021.11.09 23:01:02 App Proxy: Utilization of unreachable poller processes over 80% prd-Server3 127.0.0.1 Utilization of unreachable poller data collector processes, in % 100 %


4) 448232 Average 2021.11.09 09:56:02 App Proxy: Utilization of unreachable poller processes over 70% prd-Server4 127.0.0.1 Utilization of unreachable poller data collector processes, in % 100 %

 

BOLD - Field1

Underlined -Field2

Strikethrough - Field3

 

@ITWhisperer @javiergn @richgalloway  Please have a look at this.

 

Thank you

Labels (4)
0 Karma

srinivas_gowda
Path Finder

Hello, thanks for the response. But, this is not working for the highlighted fields.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In what way is it not working? Which fields are you not getting? Which events is it not working for? The more information you can give about your issue, the more likely we will be able to come up with a helpful answer!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\d+\s\w+\s(?<time>\d{4}\.\d{2}\.\d{2}\s\d{2}:\d{2}:\d{2})\s(?<field1>.+)\s(?<server>\S+)\s(?<ip>\d+\.\d+\.\d+\.\d+)"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...