Splunk Search

How to extract field names from Arris_log? I need help extracting alert numbers from these different raw logs.

avishek08
New Member

I need help extracting alert numbers from these different raw logs. I have tried using Field extractor and not having any luck aggregating them into a list or count

1: Oct 26 11:14:51 192.168.69.50 pfsp: Host Detection alert #21780827, start 2017-10-26 16:14:45 GMT, duration 6, direction incoming,

2: Oct 26 11:13:56 192.168.69.50 pfsp: TMS mitigation 'Alert 21780825 Auto-Mitigation' started at 2017-10-26 16:13:55

If possible please help me find appropriate "rex" command so I can learn too 🙂

0 Karma
1 Solution

alemarzu
Motivator

@avishek08

Try this regex.

... | rex "(?:alert\s#|\'Alert\s)(?<my_numbers>\d+)(?:\,\s|\s)" | stats count by my_numbers

View solution in original post

0 Karma

alemarzu
Motivator

@avishek08

Try this regex.

... | rex "(?:alert\s#|\'Alert\s)(?<my_numbers>\d+)(?:\,\s|\s)" | stats count by my_numbers
0 Karma

avishek08
New Member

Thank you so much 🙂

0 Karma

alemarzu
Motivator

Glad it worked out. Cheers!

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...