Splunk Search

How to create named fields with regular expression

dabroma5
Explorer

Hi Team

I need to filter logs to catch switches port numbers. I use Splunk Cloud, my expression:

\beth\d*(?:-\d+)*(?:/\d+(?:\.\d+)?)?\b

How to create named field?

Many Thanks

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi dabroma5,
you can create a field using rex command ( https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Rex 😞

| rex "\beth\d*(?<field1>\d+)"

I cannot be more precise without an example and the indication of what values you want to extract in fields.

P.S.: to display regexes use the Code Sample button.

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi dabroma5,
you can create a field using rex command ( https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Rex 😞

| rex "\beth\d*(?<field1>\d+)"

I cannot be more precise without an example and the indication of what values you want to extract in fields.

P.S.: to display regexes use the Code Sample button.

Ciao.
Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi dabroma5,
If all your ports are called Eth or eth, try this:

| rex "(?<port>(Eth|eth)[^\"]*)"

You can test it at https://regex101.com/r/nE5Zjt/1

Ciao.
Giuseppe

0 Karma

dabroma5
Explorer

Hi Giuseppe,

Works partially, on below notification I am receiving Ethernet Module instead of Eth1/18

{"info":{"seqno":0,"evtType":1,"oTime":null,"links":null,"id":"4a063431-fb65-11e9-a309-fd988b74a8c5","origin":null,"relations":[],"details":"","severity":5,"time":1572474806370,"headId":"4a063431-fb65-11e9-a309-fd988b74a8c5","sa":2},"desc":{"alertId":{"desc":"","label":"Link down"},"pointId":[{"desc":"Type: cisco\nIP: A.B.C.D","label":"device-name [A.B.C.D]"},{"desc":"","label":""},{"desc":"Ethernet Module","label":""},{"desc":"","label":"Eth1/18"}]},"id":{"alertId":"Link-down","component":1,"pointId":["A-B-C-D","dev","1","180000"]}}

Thanks
Marcin

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dabroma5,
Try this.

| rex "\"label\":\"(?<port>(Eth|eth)[^\"]*)"

that you can test at https://regex101.com/r/nE5Zjt/2

Ciao.
Giuseppe

0 Karma

dabroma5
Explorer

Hi Giuseppe,

| rex "\"label\":\"(?(Eth|eth)[^\"]*)" - works perfect

thanks
Marcin

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Marcin,
if this answer solves your problem, please accept and/or upvote it

Ciao and next time!
Giuseppe

0 Karma

dabroma5
Explorer

I wasn't enough specific. Below is part of my log:

{"info":{"seqno":0,"evtType":1,"oTime":null,"links":null,"id":"9b0ae9a9-e424-11e9-a309-fd988b74a8c5","origin":null,"relations":[],"details":"","severity":5,"time":1569918148265,"headId":"9b0ae9a9-e424-11e9-a309-fd988b74a8c5","sa":2},"desc":{"alertId":{"desc":"The network port is down","label":"Link down"},"pointId":[{"desc":"Type: openflow\nIP: a.b.c.d","label":"device_name [a.b.c.d]"},{"desc":"","label":""},{"desc":"Network Interfaces","label":""},{"desc":"","label":"eth-0-36"}]},"id":{"alertId":"16","component":1,"pointId":["a-b-c-d","dev","1","36"]}}

Port notation can be different depends on the device:
Eth1/1.2; Eth1/2.500; eth-0-19/4; eth-0-4; Eth1/4

How to create named field to present information in a table.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...