Splunk Search

How to extract field names from Arris_log? I need help extracting alert numbers from these different raw logs.

avishek08
New Member

I need help extracting alert numbers from these different raw logs. I have tried using Field extractor and not having any luck aggregating them into a list or count

1: Oct 26 11:14:51 192.168.69.50 pfsp: Host Detection alert #21780827, start 2017-10-26 16:14:45 GMT, duration 6, direction incoming,

2: Oct 26 11:13:56 192.168.69.50 pfsp: TMS mitigation 'Alert 21780825 Auto-Mitigation' started at 2017-10-26 16:13:55

If possible please help me find appropriate "rex" command so I can learn too 🙂

0 Karma
1 Solution

alemarzu
Motivator

@avishek08

Try this regex.

... | rex "(?:alert\s#|\'Alert\s)(?<my_numbers>\d+)(?:\,\s|\s)" | stats count by my_numbers

View solution in original post

0 Karma

alemarzu
Motivator

@avishek08

Try this regex.

... | rex "(?:alert\s#|\'Alert\s)(?<my_numbers>\d+)(?:\,\s|\s)" | stats count by my_numbers

View solution in original post

0 Karma

avishek08
New Member

Thank you so much 🙂

0 Karma

alemarzu
Motivator

Glad it worked out. Cheers!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.