Splunk Search

How to Combine Two Regex to Form One Variable

jepoyyyy
Explorer

Hi all,

I have events similar to these:

[10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000001
[10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000001
[10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000002
[10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000002

My objective is to extract TrxThread and subsNumber (ex. 1000000001) and combine them into one variable so that I could differentiate each transaction even though they have the same TrxThread

My end goal is to measure the duration so I'll be using the search below once I get the combined transaction thread and subs number
| stats earliest(_time) as start latest(_time) as end by combined_trx_id | eval dur=end-start

Thanks in advance!

Kindest regards,
Jeff

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

Try like this

.... | rex "Thread\((?<tid>\w+).*for\s(?<id>\d+)$" | eval combined_trx_id=tid."::".id

View solution in original post

sundareshr
Legend

Try like this

.... | rex "Thread\((?<tid>\w+).*for\s(?<id>\d+)$" | eval combined_trx_id=tid."::".id

jepoyyyy
Explorer

it worked perfectly. Thanks a lot sir!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...