Splunk Search

Multiple rex expressions

subspacefield
Engager

I'm trying to write to write a search to extract a couple of fields using rex. The text string to search is:

"SG:G006 Consumer:CG-900004_T01 Topic:ingressTopic Session: bc77465b-55fb-46bf-8ca1-571d1ce6d5c5  LatestOffset:1916164 EarliestOffset:0 CurrentOffset:1916163 MessagesToConsume:2"

I trying the following but nothing gets returned:

index=... | rex "MessagesToConsume:(?P<MessagesToConsume>\d+) CurrentOffset:(?P<CurrentOffset>\d+)" | where MessagesToConsume>1 | table CurrentOffset MessagesToConsume

CurrentOffset and MessagesToConsume are always empty, what am I doing wrong?

Thanks!

Labels (1)
0 Karma
1 Solution

MKozanic
Path Finder

Hi @subspacefield ,

if that is exactly how you have in your search then there are 2 issues.

  1. for rex - you need to tell it what to look at: 
  2. Rex works as you would read something - when extracting you need to extract in the order things appear in the data.

Yours rex command:  
| rex "MessagesToConsume:(?P<MessagesToConsume>\d+) CurrentOffset:(?P<CurrentOffset>\d+)"

Corrected rex command:  
| rex field=_raw "CurrentOffset:(?P<CurrentOffset>\d+) MessagesToConsume:(?P<MessagesToConsume>\d+)"

When working with issue like this, regex101.com is your best friend: 
https://regex101.com/r/4CkJF0/1

View solution in original post

0 Karma

MKozanic
Path Finder

Hi @subspacefield ,

if that is exactly how you have in your search then there are 2 issues.

  1. for rex - you need to tell it what to look at: 
  2. Rex works as you would read something - when extracting you need to extract in the order things appear in the data.

Yours rex command:  
| rex "MessagesToConsume:(?P<MessagesToConsume>\d+) CurrentOffset:(?P<CurrentOffset>\d+)"

Corrected rex command:  
| rex field=_raw "CurrentOffset:(?P<CurrentOffset>\d+) MessagesToConsume:(?P<MessagesToConsume>\d+)"

When working with issue like this, regex101.com is your best friend: 
https://regex101.com/r/4CkJF0/1

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...