Splunk Search

I need to get the State from that output

waruike
Engager

server_state=RUNNING server_health=Component:ServerRuntime State:HEALTH_OK MBean:managed2ReasonCode:[]

this is the snippet that i need to get the state from

I am a beginner in splunk 

Labels (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try

|rex field=<your filedname> "State:(?<State>.+?),"

 

Test

|makeresults|eval text="| server_state=RUNNING | server_health=Component:ServerRuntime , State:HEALTH_OK , MBean:managed2, ReasonCode:[]"
|rex field=text "State:(?<State>.+?),"

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try

|rex field=<your filedname> "State:(?<State>.+?),"

 

Test

|makeresults|eval text="| server_state=RUNNING | server_health=Component:ServerRuntime , State:HEALTH_OK , MBean:managed2, ReasonCode:[]"
|rex field=text "State:(?<State>.+?),"

View solution in original post

0 Karma

waruike
Engager

I need to extract the field and add it to a table

see here

`index_wls` server=* server_state=* domain=* server_health=* | dedup host,server | table host,server ,server_state, 

now from the State I want to add a Row Status to my table to be like

`index_wls` server=* server_state=* domain=* server_health=* | dedup host,server | table host,server ,server_state, Status

0 Karma