Issue with regex

[bharpur183]

This is the event :

02OCT2017_16:46:47.212 130880:140149567481600 INFO event.py:177 root event = {"hopTrace": {"hops": [{"machine": {"nodeId": 569}, "application": {"processId": 19295, "processName": "udrqssvc.tsk", "appName": "DRQS"}, "authenticatedUser": {"uuid": 10095155}}]}, "event": {"eventType": "DRQS UPDATED", "drqsNumber": 107516809(FIELD5), "newHeader": {"status": "Q", "function": "N539", "billToId": 5028, "yellowKey": "", "billToType": "HIER", "lastUpdateTime": "2017-10-02T20:46:47.000+00:00", "type": "IW", "creatorUuid": 1603009, "slaCategory": -1, "summary": "MM/DD n539 hardware failure IBM PMR: 24465.L6Q.000", "queue": "", "timeClosed": "1899-12-31T05:00:00.000+00:00", "ouTypeCode": 0, "routeToGroup": 270(FIELD4), "ouTypeDescription": "", "tsCustomerNumber": 0, "closedUuid": 0, "lastUpdateUuid": 10095155, "createTime": "2017-09-29T12:00:48.000+00:00", "ownerUuid": 2984495}, "logNotes": [{"logNoteId": "1049598095", "timestamp": "2017-10-02T20:46:47.141+00:00", "authorUuid": 10095155, "logText": [{"text": "Note added from offline, remote machine 208\n", "textType": "DEEMPHASIZED"}, {"text": "{FIFW PRQS 160269881(FIELD6)} submitted to take N539(FIELD1) (N539) offline on Tue Oct 03 2017 19:00:00 GMT-0400 (EDT)(FIELD2) for HARDWARE REPAIRS(FIELD3)\n", "textType": "NORMAL"}], "isAutomated": true}]}, "metadata": {"publishId": "121785005", "publishTime": "2017-10-02T16:46:47.189-04:00"}}

From the above event I want to create a statistics table with Field1-Fileds 6
I have highlighted the needed fields as bold . I get some of them but not all 6 fields

[bharpur183]

Sorry forgot to mention that I tried that but the problem is the field is

Tue Oct 03 2017 19:00:00 GMT-0400 (EDT)(FIELD2

and sorting by field2 it goes alphabetically and not the actual dates
Can the day be eliminated somehow ?

[inventsekar]

Can the day be eliminated somehow - meaning, you want to sort by the date(03 on the date - Tue Oct 03 2017 19:00:00 GMT-0400) ?

[bharpur183]

Basically it sorts as Oct 03 2017 19:00:00 GMT-0400)

[bharpur183]

It shouldn't sort by the days

[inventsekar]

not getting your question..
maybe, please check this post for sorting a date value -
https://answers.splunk.com/answers/290983/days-in-alphabetical-order-but-need-to-be-in-day-o.html

[bharpur183]

I mean when am sorting the results by date this is the table I get :

Fri Oct 06 2017 13:00:00 GMT-0400 (EDT)
Sat Oct 07 2017 12:00:00 GMT-0400 (EDT)
Thu Oct 05 2017 06:00:00 GMT-0400 (EDT)
Tue Oct 03 2017 13:00:00 GMT-0400 (EDT)
Tue Oct 03 2017 18:00:00 GMT-0400 (EDT)
Tue Oct 03 2017 18:00:00 GMT-0400 (EDT)
Tue Oct 03 2017 19:00:00 GMT-0400 (EDT)
Wed Oct 04 2017 13:00:00 GMT-0400 (EDT)
Wed Oct 04 2017 13:00:00 GMT-0400 (EDT)
Wed Oct 04 2017 19:30:00 GMT-0400 (EDT)

and its based on the alphabetical order and not the actual dates

[inventsekar]

generally there is an extracted field "date_mday", which is the day-month. you can try to sort using this one...

| table HOSTNAME , DRQS , PRQS , WINDOW , MAINTENANCE Field2 | fillnull value="NULL" | search HOSTNAME!="NULL" AND DRQS!="NULL" AND PRQS!="NULL" AND WINDOW!="NULL" | dedup HOSTNAME | sort date_mday

[inventsekar]

Hi @bharpur183, Can you please accept this as answer, so that it will be marked as solved, while you do that you will get karma points as well.. you can upvote the answer and comments too 😉

[sduff_splunk]

| rex field=_raw "(?<field6>\S+) submitted to take (?<field1>\S+) .* offline on (?<field2>.*) for (?<field3>[^\"]+)\""

| rex field=_raw "\"drqsNumber\": (?<field5>\S+),"

| rex field=_raw "\"routeToGroup\": (?<field4>\S+),"

[bharpur183]

get an error :

Error in 'rex' command: Encountered the following error while compiling the regex '(?.*) for (?[^"]+)"': Regex: syntax error in subpattern name (missing terminator)

[sduff_splunk]

I've updated the query

[bharpur183]

Thanks . That works . can you please provide the same for fields 1 and field 5 ?

[sduff_splunk]

Updated. Please look at the rex command to learn how this command works.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

http://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions