Hi,
We have below type of logs:
Log1-- 2021-02-02 10:12:49.889, APP_NAME="com.abcdef.abcdefghijkl", APP_TEMP_NAME="com.abcdef.abcdefghijkl", APP_TEMP_VER="1.0.11.20210120114351539", LASTDEPLOYED="2021-01-27 13:41:12.389", ENV_NAME="ABCEnvironment_AB"
Log2-- 2021-02-02 10:12:49.889, APP_NAME="com.abcdef.st.xyz", APP_TEMP_NAME="com.abcdef.st.xyz-1", APP_TEMP_VER="1.1.4", LASTDEPLOYED="2018-11-18 05:59:44.333", ENV_NAME="ABCEnvironment_CD"
From here I want to extract the below fields with separate rex commands for each.
APP_NAME, APP_TEMP_NAM, APP_TEMP_VER, LASTDEPLOYED, ENV_NAME
But I am unable to create the rex commands as expected.
Can someone please help me in creating the rex commands..?
| rex "APP_NAME=\\\"(?P<APP_NAME>[^\\\"]+)"
| rex "APP_TEMP_NAME=\\\"(?P<APP_TEMP_NAME>[^\\\"]+)"
| rex "APP_TEMP_VER=\\\"(?P<APP_TEMP_VER>[^\\\"]+)"
| rex "LASTDEPLOYED=\\\"(?P<LASTDEPLOYED>[^\\\"]+)"
| rex "ENV_NAME=\\\"(?P<ENV_NAME>[^\\\"]+)"
Thank you richgalloway for your support.
| rex "APP_NAME=\\\"(?P<APP_NAME>[^\\\"]+)"
| rex "APP_TEMP_NAME=\\\"(?P<APP_TEMP_NAME>[^\\\"]+)"
| rex "APP_TEMP_VER=\\\"(?P<APP_TEMP_VER>[^\\\"]+)"
| rex "LASTDEPLOYED=\\\"(?P<LASTDEPLOYED>[^\\\"]+)"
| rex "ENV_NAME=\\\"(?P<ENV_NAME>[^\\\"]+)"
Hi ITWhisperer,
Thank you very much for your support. The commands are working fine.
What have you tried so far? Have you used regex101.com to help construct regexes?
The general form of the regex is
{fieldName}=\"(?<{fieldName}[^\"]+)
where {fieldName} is a placeholder for the field you wish to extract. When applied to the rex command it becomes, for example:
| rex "APP_NAME=\\\"(?<APP_NAME>[^\\\"]+)"
The extra backslashes are for the multiple layers the regex passes through before it reaches Splunk's regex parser.