Help with regular expression

[nanachu]

Hi, all

I would like to create a mechanism that generates an alert when a regular expression extracted matches.

However, I cannot come up with a search statement that says when the extracted regular expression matches a certain character.

Here is my regular expression.

index=main sourcetype=text
|rex field = title(?<description>(\[).*(\]))

Field of title has values [SUCCESS],[FAILED],[SKIPPED]etc...

I thought that this search statement would return results that matched SUCCESS.

index=main sourcetype=text
|rex field = title(?<description>(\[).*(\]))
description = "SUCCESS"

But, it does not work.

Could you please help me?

[diogofgm]

You can use the | regex to search events regex patterns without the need to extract fields.

Example:
if you want to get an alert when there is a [FAILED] event you can search:

index=main sourcetype=text
| regex _raw="\[FAILED\]"

NOTE: You can swap _raw by other existing field if you want.

More information on the regex command:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/SPLandregularexpressions

Also check this .conf presentation:
https://conf.splunk.com/files/2017/slides/regex-in-your-spl.pdf

[Adrian_ftx · Accepted solution]

Hi nanachu,

If you want to create an alert then you can do something like:

 index=main sourcetype=text
|rex field=title "\[(?<description>.*)\]"
|stats count by description

(it will count the number of "[SUCCESS]", "[FAILED]", ... extracted)
Then you click "save as" --> Alert --> Trigger alert when "Number of Results" is greater than 0

Hope it helps

Best regards,
Adrian

[Sukisen1981]

try this

| makeresults
| eval title="[SUCCESS],[FAILED],[SKIPPED]" |rex field=title "\[+(?<status>.*?)\]" max_match=0
| mvexpand status
| where status="whatever you want"

repalce whatever you want with success,failed,skipped etc...

[Sukisen1981]

hi @nanachu
Can you please check and confirm on your issue? Please accept the answer if it significantly helped resolve your issue. Do not forget to add/modify the answer if you did some modifications and then accept the answer.