Splunk Search

How to Combine Two Regex to Form One Variable

jepoyyyy
Explorer

Hi all,

I have events similar to these:

[10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000001
[10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000001
[10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000002
[10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000002

My objective is to extract TrxThread and subsNumber (ex. 1000000001) and combine them into one variable so that I could differentiate each transaction even though they have the same TrxThread

My end goal is to measure the duration so I'll be using the search below once I get the combined transaction thread and subs number
| stats earliest(_time) as start latest(_time) as end by combined_trx_id | eval dur=end-start

Thanks in advance!

Kindest regards,
Jeff

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

Try like this

.... | rex "Thread\((?<tid>\w+).*for\s(?<id>\d+)$" | eval combined_trx_id=tid."::".id

View solution in original post

sundareshr
Legend

Try like this

.... | rex "Thread\((?<tid>\w+).*for\s(?<id>\d+)$" | eval combined_trx_id=tid."::".id

jepoyyyy
Explorer

it worked perfectly. Thanks a lot sir!

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...