Splunk Search

How come the rex command is not working like normal regex?

jmorri6
Engager

Given a string:

(path=/myPath/123/endpoint,method=GET,accept=text/plain;version=0.0.4;q=1,*/*;q=0.1,content-type=null,accept-encoding=gzip,totalTime=127),

I want to retrieve the value for "path" and "totalTime" to create a visualization.

The rex...

rex field=log "path=(?< endpoint>\/\w+),totalTime=(?< milliseconds>\d+)"

...doesn't produce any results. I've tried several variations. Can anyone help with this rex?

It doesn't produce any results.

0 Karma
1 Solution

renjith_nair
Legend

@jmorri6

Try

path=(?<endpoint>[\/\w\d]+).+totalTime=(?<milliseconds>\d+)
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

tsaikumar009
Explorer

rex "path=(?P< endPoint>.*?)," | rex "totalTime=(?P< milliseconds>\d+)"

add these rex to your query to get the results.

0 Karma

renjith_nair
Legend

@jmorri6

Try

path=(?<endpoint>[\/\w\d]+).+totalTime=(?<milliseconds>\d+)
---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...