Splunk Search

Help with regex to extract field "failure" and add to field called "error"

denisevw
Path Finder

Can anyone help me with a regular expression for an extraction please?

Need to extract "failure" from below and add to field called "Error":

160.2:ERR Code = <1/failure/7353280025534419>

This regex does not work:

rex field=_raw "\d+\:ERR\s+Code\s+\=\s\<1\/(?P<Error>[^\>]+)\/[0-9]\>"

Thanks in advance.

Tags (2)

alacercogitatus
SplunkTrust
SplunkTrust

REGEX! YAY!

<your_search> | rex field=_raw "\d+\:ERR\s+Code\s+=\s+<1/(?<Error>[^/]+)/"
0 Karma

somesoni2
Revered Legend

Try this

your base search | rex "\<\d+\/(?<Error>\w+)\/"
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

heh, I should reload page before answering :grinning_face_with_smiling_eyes:

linu1988
Champion

Hello,
Am not sure which part exactly would you like to extract.

if it's failure: |rex field=_raw "\/(?<Error>\S+)\/"

if it's the long digit which is the error code then: |rex field=_raw "\/(?<Error>\d+)\>"

Thanks,
L

0 Karma

linu1988
Champion

do you get any error? and is this all you have in the _raw data? try with more match...

|rex field=_raw "\\d+\/(?<Error>\S+)\/"
0 Karma

denisevw
Path Finder

The above regex did not work in my search.

0 Karma

denisevw
Path Finder

Thanks for the reply. I want to extract only the word "failure"

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...