Need to extract required fields using rex command

[rakesh44]

Hi Friends

I am trying to extract required field from events using rex command. Can someone please help me, logs are given in attached doc.

I am new to rex command , Once i get below rex command then easy to understand

Below are fields need to extract

Kernel Audit Begin, Kernel Begin,pam_unix Begin,Postfix Begin,-SSHD Begin,Sudo (secure-log) Begin,Disk Space Begin

[gcusello · Accepted solution]

Hi rakesh44,
let mi know: do you want to extract the following fields?

• TimeStamp
• Date Range Processed
• Detail Level of Output
• Type of Output/Format
• Logfiles for Host

If these are the fields to extract from the example you shared, try to use the following regex

Processing Initiated: (?<TimeStamp>\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.*Date Range Processed:\s+yesterday\s+\(\s+(?<Date_Range>[^ ]*)\s+.*\s+.*\s+Detail Level of Output:(?<Level_of_input>[^ ]*)\s+Type of Output\/Format:\s+(?<Type>.*)\s*Logfiles for Host: (?<Logfile>[^ ]*)\s+\#

You can test it at https://regex101.com/r/JNMRCz/1

Bye.
Giuseppe

[rakesh44]

Thanks Gcusello , it worked for me rest I would create it

Processing Initiated: (?\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.Date Range Processed:\s+yesterday\s+(\s+(?[^ ])\s+.\s+.\s+Detail Level of Output:(?[^ ])\s+Type of Output\/Format:\s+(?.)\s*Logfiles for Host: (?[^ ]*)\s+#

[gcusello]

Good!
if you're satisfied of this answer, please accept and/or upvote it.
At the next time.
Bye.
Giuseppe

[vishaltaneja070]

can you give me the sample value of extraction required for Kernel Audit Begin?

[rakesh44]

I have to prepare dashboard for each field as mentioned, hence need all values of fields.
Kernel Audit Begin : Nee all values of field

[rakesh44]

Unmatched Entries (Only first 100 out of 127 are printed)
dispatch err (pipe full) event lost
dispatch error reporting limit reached - ending report notification.