Splunk Search

Inline field extraction with rex

lukejadamec
Super Champion

I'm not a big regex power yet, I know this is easy, but since it is not on a system I can't test and figure out myself I'm looking for expert assistance.
Can someone provide a search rex that will pull both the interface and up-down fields from this log?

Oct  9 12:01:18 hos-a-3550-1.rockefeller.internal 2635634: Oct  9 12:01:17: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to down
Oct  9 12:01:18 hos-a-3550-1.rockefeller.internal 2635634: Oct  9 12:01:17: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to up

Looking for a rex that pulls two fields:

search | rex field=_raw ?(?<interface>?)?(?<up-down>?)? | stats count by interface,up-down

Thanks,

Luke

Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Here

mysearch | rex "Interface (?<interface>[^, ]*), changed state to (?<state>\w+)" | table interface state

View solution in original post

yannK
Splunk Employee
Splunk Employee

Here

mysearch | rex "Interface (?<interface>[^, ]*), changed state to (?<state>\w+)" | table interface state

yannK
Splunk Employee
Splunk Employee
0 Karma

lukejadamec
Super Champion

Thanks. I totally need to learn regex.

0 Karma

yannK
Splunk Employee
Splunk Employee

please show that you are looking for precisely.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...