Splunk Search

Need help on Rex filter

jerinvarghese
Communicator

Hi All,

Need help in getting the right rex filter for the below _raw data.

 

2021-12-04T01:29:48.015524+00:00 USHCO-EXXON, ipsec-ike-down, 689, "IKE connection with peer 10.218.42.113 (routing-instance EXXON-Control-VR) is up", USPAB

2021-12-04T01:29:15.007722+00:00 USHCO-EXXON, ipsec-tunnel-down, 687, "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB

2021-12-04T01:29:15.007722+00:00 USHCO-EXXON, ipsec-ike-down, 686, "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB

2021-12-04T01:29:14.807814+00:00 USHCO-EXXON, ipsec-tunnel-down, 872, "IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB

2021-12-04T01:29:14.807814+00:00 USHCO-EXXON, ipsec-ike-down, 871, "IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up", USPAB

 

 

Above is the raw data.

 

Requirement : 

All the content within " " need to filtered.

Example

 

 

"IKE connection with peer 10.218.42.113 (routing-instance EXXON-Control-VR) is up"
"IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up"
"IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up"
"IPSEC tunnel with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up"
"IKE connection with peer 10.218.42.111 (routing-instance EXXON-Control-VR) is up"

 

 

Above content to be filtered into Event_Log

 

| rex field=_raw "(?<Event_Log>[^"]+)"

 

But something am missing, its not capturing the data

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jerinvarghese,

what do you really intend with filter?

do you want to extract the strinbgs between quotes in a field or don't display them?

if you want to put in a field called "Event_Log", you could use a regex like this:

| rex "\"(?<Event_Log>[^\"]+)\""

you can test the regex at https://regex101.com/r/hkPiCZ/1

ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @jerinvarghese,

what do you really intend with filter?

do you want to extract the strinbgs between quotes in a field or don't display them?

if you want to put in a field called "Event_Log", you could use a regex like this:

| rex "\"(?<Event_Log>[^\"]+)\""

you can test the regex at https://regex101.com/r/hkPiCZ/1

ciao.

Giuseppe

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...