Splunk Search

How to Combine Two Regex to Form One Variable

jepoyyyy
Explorer

Hi all,

I have events similar to these:

[10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000001
[10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000001
[10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000002
[10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000002

My objective is to extract TrxThread and subsNumber (ex. 1000000001) and combine them into one variable so that I could differentiate each transaction even though they have the same TrxThread

My end goal is to measure the duration so I'll be using the search below once I get the combined transaction thread and subs number
| stats earliest(_time) as start latest(_time) as end by combined_trx_id | eval dur=end-start

Thanks in advance!

Kindest regards,
Jeff

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

Try like this

.... | rex "Thread\((?<tid>\w+).*for\s(?<id>\d+)$" | eval combined_trx_id=tid."::".id

View solution in original post

sundareshr
Legend

Try like this

.... | rex "Thread\((?<tid>\w+).*for\s(?<id>\d+)$" | eval combined_trx_id=tid."::".id

jepoyyyy
Explorer

it worked perfectly. Thanks a lot sir!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...