Splunk Search

How extract field using rex?

karthi2809
Builder

How to extract fields in between | servername |

Which i am using in rex 

^[^\|\n]*\|(?P<Server>\w+\.\w+\.\w+\.\w+\s+)

But its not extracting the all the servers

05-Apr-2023 04:42:44:PM: |IISN11WCRL02.nnp.anp.co.xx | Ping statistics for 10.10.10.194: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 54ms, Maximum = 54ms, Average = 54ms
4/5/23
4:42:41.000 AM
05-Apr-2023 04:42:41:PM: |IISN11WCRL02.nnp.anp.co.xx | Ping statistics for 10.10.10.194: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 54ms, Maximum = 57ms, Average = 54ms
4/5/23
4:42:38.000 AM
05-Apr-2023 04:42:38:PM: |IIISN11WCRL02.nnp.anp.co.xx | Ping statistics for 10.10.10.194: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 53ms, Maximum = 54ms, Average = 53ms
4/5/23
4:42:34.000 AM
05-Apr-2023 04:42:34:PM: |naz11sry001l | Ping statistics for 10.10.10.194: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 53ms, Maximum = 55ms, Average = 54ms
4/5/23
4:42:31.000 AM
05-Apr-2023 04:42:31:PM: |naz11sry002l | Ping statistics for 10.10.10.194: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 53ms, Maximum = 55ms, Average = 54ms

Labels (1)
Tags (1)
0 Karma
1 Solution

Gr0und_Z3r0
Contributor

@karthi2809  you can try something like this....

 

|  rex field=_raw "\|(?P<Server>[\w\.]+)\s\|"

 

 

Gr0und_Z3r0_0-1680762808420.png


~ If the reply helps an upvote would be appreciated.

View solution in original post

Gr0und_Z3r0
Contributor

@karthi2809  you can try something like this....

 

|  rex field=_raw "\|(?P<Server>[\w\.]+)\s\|"

 

 

Gr0und_Z3r0_0-1680762808420.png


~ If the reply helps an upvote would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| rex "^[^\|\n]*\|(?P<Server>[^\|]+)"
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...