Splunk Search

Need help with syntax and rex

LizAndy123
Explorer

I have a log with a sample of the following

POST Uploaded File Size for project id : 123 and metadata id : xxxxxxxxxxxx is : 1234 and time taken to upload is: 51ms

 

So this is project id : 123

Size is 1234

Upload Speed is 51ms

I what to extract the project id , size and the upload time as fields 

also regarding the upload time I guess I just need the number right.

 

Labels (3)
0 Karma
1 Solution

jawahir007
Communicator

Try this :

|rex "project\sid[\s\:]+(?<project_id>[^\s]+).+?is[\s\:]+(?<size>[^\s]+).+?is[\s\:]+(?<upload_time_ms>\d+)"

 

View solution in original post

LizAndy123
Explorer

Thanks both of you - both work :-0)

0 Karma

jawahir007
Communicator

Try this :

|rex "project\sid[\s\:]+(?<project_id>[^\s]+).+?is[\s\:]+(?<size>[^\s]+).+?is[\s\:]+(?<upload_time_ms>\d+)"

 

gcusello
SplunkTrust
SplunkTrust

Hi @LizAndy123 ,

please try this:

| rex "project id : (?<Project_Id>\d+) and metadata id : \w+\sis\s:\s(?<Size>\d+) and time taken to upload is: (?<Upload_Speed>\w+)"

that you can test at project id : (?<Project_Id>\d+) and metadata id : \w+\sis\s:\s(?<Size>\d+) and time taken to upload is: (?<Upload_Speed>\w+)

Ciao.

Giuseppe

Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...