Need help in extraction

[srinivas_gowda]

Hello team, 

I am facing an issue while trying to extract the below events. Please help in this.

Event:

150022 High 2021.11.22 03:32:44 App Proxy: Utilization of preprocessing manager processes over 80% prd-Server06 1.2.3.4 Utilization of preprocessing manager internal processes, in % 100 %

Extraction used:

^(?:[^:\n]*:){2}\d+\s+(?P<field1>[^\t]+)(?:[^\.\n]*\.){3}\d+\s+(?P<field2>[^ ]+)(?:[^ \n]* ){7}\%\s(?P<field3>.+)

Although all other fields are extracted as expected. The field2 is unable to extract the highlighted/underlined field. Please let me know how I may fix the field2 here.

[srinivas_gowda]

By using this, the Source from the below event is not being extracted. I am looking at something that can work on all extractions. The highlighted is the source from the event.

564574 High 2021.11.29 09:17:44 KOBE1024-S-06F-HUB01 has been restarted (uptime < 10m) KOBE1024-S-06F-HUB01 10.227.1.221 Uptime 00:00:51

[ITWhisperer]

Can you give examples of all the different sorts of events you want to extract fields from and highlight using different colours which parts belong to which belong to which fields using the same colour for the same field?

The two examples given so far differ in that the second one does not have % in which is used in the first pattern to anchor the field. Unless they have common anchors across all events, you may not be able to extract from all the events with a common expression.

[ITWhisperer · Accepted solution]

You had a misplaced closing bracket for the field2 pattern

^(?:[^:\n]*:){2}\d+\s+(?P<field1>[^\t]+)(?:[^\.\n]*\.){3}\d+\s+(?P<field2>[^ ]+(?:[^ \n]* ){7})\%\s(?P<field3>.+)