Splunk Search

How to Extract exact result from rex command?


rex field=_raw "MemoryUsage %(?<MemoryUtilization>[^']+)"

MY result is

------------ 41.4


expected result



Labels (2)
0 Karma



i have to extract only 500 ?
Server returned HTTP response code: 500 for

My regex: rex field=_raw "Server returned HTTP response code:\s(?.+)"

i have to trim only 500

0 Karma

Esteemed Legend

Like this:

| makeresults 
| eval _raw="| va1eb01 | PROD | Provider86 | 2017-06-14 18:03:19,726 | ERROR | http-- | com.amerigroup.geocode.v3geocoder.GoogleGeoCodeV3.getGeocodeResponse(GoogleGeoCodeV3.java:252) | IOException, geocodeUrl=**http://maps.google.com/maps/api/geocode/xml?sensor=false&client=gme-amerigroupcorp&address=5741+S+FT+APACHE+RD+STE+100%2CLAS+VEGAS%2CNV+89148-5622%2CUSA&signature=o3Jsz1z-qNPB35WGdVY-bPFrMc8=: java.io.IOException: Server returned HTTP response code: 500 for URL: http://maps.google.com/maps/api/geocode/xml?sensor=false&client=gme-amerigroupcorp&address=5741+S+FT... at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1626) at com.amerigroup.geocode.v3geocoder.GoogleGeoCodeV3.getGeocodeResponse(GoogleGeoCodeV3.java:229) ... 46 lines omitted ..."

| rename COMMENT AS "Everything above generates sample event data; everything below is your soluition"

| rex "^(?:[^\|]*\|){1}(?<field1>[^\|]*)\|(?:[^\|]*\|){1}(?<field2>[^\|]*)\|"

Esteemed Legend

Hi karthi2809,
try this regex (please confirm that at the start of a row there are two pipes |):

\|\|\s+(?<field1>[^ ]*)\s+\|\s+[^ ]*\s+\|\s+(?<field2>[^ ]*)

You can test it at https://regex101.com/r/bVp3gz/1

Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...