Splunk Search

Need help on rex

rishiaggarwal
Explorer

Hi Team,

Need help to extract fields for the following. Please help rex for the below.

    'ConnID'    '007202761fdb2c01'
    'VirtualQueue'  'ABC_EFG_BJFNKJFN'
Tags (1)
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

If these are single line events:

\'ConnID\'\s+\'(?<ConnID>[^\']+)'

And

\'VirtualQueue\'\s+\'(?<VirtualQueue>[^\']+)'

Multiline events are a bit different. You need to make sure that the events are process properly as multiline, then you can do something like..

  (?m) \'ConnID\'\s+\'(?<ConnID>[^\']+)'\n\'VirtualQueue\'\s+\'(?<VirtualQueue>[^']+)'

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

If these are single line events:

\'ConnID\'\s+\'(?<ConnID>[^\']+)'

And

\'VirtualQueue\'\s+\'(?<VirtualQueue>[^\']+)'

Multiline events are a bit different. You need to make sure that the events are process properly as multiline, then you can do something like..

  (?m) \'ConnID\'\s+\'(?<ConnID>[^\']+)'\n\'VirtualQueue\'\s+\'(?<VirtualQueue>[^']+)'
0 Karma

Amohlmann
Communicator

Is that the full event? Which part are you trying to extract? What are the names of the fields here?

0 Karma

renjith_nair
Legend

@rishiaggarwal , Is that the full event ? Also please clarify what you want to extract

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...