Splunk Search

How to extract a string in a variable

avneet26
Engager

I have a table in which one of the columns has logs like below

 

2022-08-21 23:00:00.877 Warning: PooledThread::run: N4xdmp29ForestCheckSchemaDBChangeTaskE::run: XDMP-XDQPNOSESSION: No XDQP session on host iuserb.nl.eu.abnamro.com, client=iuserb.nl.eu.abnamro.com, request=moreLocators, session=2026168605646879816, target=5301003730415457210

 

I want to extract the term "XDMP-XDQPNOSESSION" into a variable and then later use it. How to do that using regex or any other option ?

 

Labels (2)
0 Karma

avneet26
Engager

Basically out of my base query, I want to extract this string put it in a variable and then pass it to create an alert e-mail , where-in this string will be passed to the e-mail title. How can I do that?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

one way to do it:

... your base query
| rex "(::run:.*)+::run:(?<foo>[^:]+)"

Then you have this string on field foo.

r. Ismo 

0 Karma

avneet26
Engager

what is run here?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

"run" is taken from your example log event - it precedes "XDMP-XDQPNOSESSION" (the string you wanted to extract), but because it appears twice in your example, it needs to appear twice in the rex matching string to anchor the extract.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...