I have below 3 different set of events coming from same source. So i have extracted the field using rex command for each type of event. This is working fine when i use each 'rex' command separately. But when i combine all 3 rex commands, it's giving me 0 results. Is there any way to fix this ?
host01u,UAT,2300970,app.rmkb.hk-122,,Deployment Success
host01u,UAT,2319971,app.bww.label-34,HOLD,Deployment Success
host02u,UAT,2319237,app.static-540,No_File
My Query:
index=foo source=status.list
| rex field=_raw "(?<Server>\w+.*)\,(?<Environment>\w+.*)\,(?<Req>\d+.*)\,(?<Package>\w+.*)\,(?<Command>)\,(?<Deploy_Status>\w+.*)"
| rex field=_raw "(?<Server>\w+.*)\,(?<Environment>\w+.*)\,(?<Req>\d+.*)\,(?<Package>\w+.*)\,(?<Command>\w+.*)\,(?<Deploy_Status>\w+.*)"
| rex field=_raw "(?<Server>\w+.*)\,(?<Environment>\w+.*)\,(?<Req>\d+.*)\,(?<Package>\w+.*)\,(?<Deploy_Status>\w+.*)"
| stats latest(*) as * by Server,Environment,Package
| table Server,Environment,Req,Package,Deploy_Status
| dedup Server,Environment,Req,Package,Deploy_Status
| stats count by Deploy_Status
Try this single rex
| rex "^(?<Server>[^\,]+)\,(?<Environment>[^\,]+)\,(?<Req>[^\,]+)\,(?<Package>[^\,]+)\,(?<Command>[^\,]*)(|\,(?<Deploy_Status>[\w\s]*))$"
@ITWhisperer Thanks for your reply. This is working fine when i get all 3 types of events. But there are times in which i will get only below type of event. In this case, the given rex command is not working. Can you advise ?
host02u,UAT,2319237,app.static-540,No_File
The expression works with the string when used in regex101.com. Please can you post your query as you have it at the moment?
Below is my current query.
index=foo source=status.list
| rex "^(?<Server>[^\,]+)\,(?<Environment>[^\,]+)\,(?<Req>[^\,]*)\,(?<Package>[^\,]+)(|\,(?<Command>[^\,]*))(|\,(?<Deploy_Status>[\w\s]*))$"
| stats latest(*) as * by Server,Environment,Package
| table Server,Environment,Req,Package,Deploy_Status
| dedup Server,Environment,Req,Package,Deploy_Status
| stats count by Deploy_Status
You put in some extra characters which weren't in my suggestion
| rex "^(?<Server>[^\,]+)\,(?<Environment>[^\,]+)\,(?<Req>[^\,]*)\,(?<Package>[^\,]+)(|\,(?<Command>[^\,]*))(|\,(?<Deploy_Status>[\w\s]*))$"
Your suggestion didn't help me to capture below type of events. So i have done those changes.
host02u,UAT,2319237,app.static-540,No_File