Splunk Search

How to create named fields with regular expression

dabroma5
Explorer

Hi Team

I need to filter logs to catch switches port numbers. I use Splunk Cloud, my expression:

\beth\d*(?:-\d+)*(?:/\d+(?:\.\d+)?)?\b

How to create named field?

Many Thanks

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi dabroma5,
you can create a field using rex command ( https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Rex 😞

| rex "\beth\d*(?<field1>\d+)"

I cannot be more precise without an example and the indication of what values you want to extract in fields.

P.S.: to display regexes use the Code Sample button.

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi dabroma5,
you can create a field using rex command ( https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Rex 😞

| rex "\beth\d*(?<field1>\d+)"

I cannot be more precise without an example and the indication of what values you want to extract in fields.

P.S.: to display regexes use the Code Sample button.

Ciao.
Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi dabroma5,
If all your ports are called Eth or eth, try this:

| rex "(?<port>(Eth|eth)[^\"]*)"

You can test it at https://regex101.com/r/nE5Zjt/1

Ciao.
Giuseppe

0 Karma

dabroma5
Explorer

Hi Giuseppe,

Works partially, on below notification I am receiving Ethernet Module instead of Eth1/18

{"info":{"seqno":0,"evtType":1,"oTime":null,"links":null,"id":"4a063431-fb65-11e9-a309-fd988b74a8c5","origin":null,"relations":[],"details":"","severity":5,"time":1572474806370,"headId":"4a063431-fb65-11e9-a309-fd988b74a8c5","sa":2},"desc":{"alertId":{"desc":"","label":"Link down"},"pointId":[{"desc":"Type: cisco\nIP: A.B.C.D","label":"device-name [A.B.C.D]"},{"desc":"","label":""},{"desc":"Ethernet Module","label":""},{"desc":"","label":"Eth1/18"}]},"id":{"alertId":"Link-down","component":1,"pointId":["A-B-C-D","dev","1","180000"]}}

Thanks
Marcin

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi dabroma5,
Try this.

| rex "\"label\":\"(?<port>(Eth|eth)[^\"]*)"

that you can test at https://regex101.com/r/nE5Zjt/2

Ciao.
Giuseppe

0 Karma

dabroma5
Explorer

Hi Giuseppe,

| rex "\"label\":\"(?(Eth|eth)[^\"]*)" - works perfect

thanks
Marcin

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Marcin,
if this answer solves your problem, please accept and/or upvote it

Ciao and next time!
Giuseppe

0 Karma

dabroma5
Explorer

I wasn't enough specific. Below is part of my log:

{"info":{"seqno":0,"evtType":1,"oTime":null,"links":null,"id":"9b0ae9a9-e424-11e9-a309-fd988b74a8c5","origin":null,"relations":[],"details":"","severity":5,"time":1569918148265,"headId":"9b0ae9a9-e424-11e9-a309-fd988b74a8c5","sa":2},"desc":{"alertId":{"desc":"The network port is down","label":"Link down"},"pointId":[{"desc":"Type: openflow\nIP: a.b.c.d","label":"device_name [a.b.c.d]"},{"desc":"","label":""},{"desc":"Network Interfaces","label":""},{"desc":"","label":"eth-0-36"}]},"id":{"alertId":"16","component":1,"pointId":["a-b-c-d","dev","1","36"]}}

Port notation can be different depends on the device:
Eth1/1.2; Eth1/2.500; eth-0-19/4; eth-0-4; Eth1/4

How to create named field to present information in a table.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...