Splunk Search

Reg Ex/ REX to match patterns

Explorer

Hello All,

THis might be simple question but need some guidance here:

i'm using pattern match like below but not satisfied with using double match conditions

match(ALERT_DESCRIPTION,"(FILE_test_file)") AND match(ALERT_DESCRIPTION,"For transaction Login \. 3 out of 3 transactions failed") ), "Global FIle Issue" 

Here ALERT_DESCRIPTION is a column in a table and Global FIle Issue is where the alert has to be named if the condition satisfied.

The description has the actual description of the error ..but im filtering the errors based on the issue so using match function here ..i want to use rex function inside match(or esle pls guide me how to check 2 strings patterns in single match function instead of multiple match functions

like this

match(ALERT_DESCRIPTION,"(rex <<magic goes here>)",  "Global FIle Issue" 
0 Karma

Champion

Hi

Try this

| makeresults 
| eval ALERT_DESCRIPTION ="test For transaction Login . 3 out of 3 transactions failed 1234" 
| append 
    [| makeresults 
    | eval ALERT_DESCRIPTION ="test FILE_test_file test" ] 
| append 
    [| makeresults 
    | eval ALERT_DESCRIPTION ="test" ] 
| eval ISSUE_TYPE=case((match(ALERT_DESCRIPTION,"(FILE_test_file) | (For transaction Login \\. 3 out of 3 transactions failed)")),"Global FIle Issue",true(),"-")

SplunkTrust
SplunkTrust

try like

case(like(ALERT_DESCRIPTION,"%(FILE_test_file)%") AND like(ALERT_DESCRIPTION,"%For transaction Login \. 3 out of 3 transactions failed%"), "Global FIle Issue")
0 Karma

Explorer

@mayurr98 Thankyou for the response...my idea is to shorten the query (cutdown the usage of multiple AND)

im getting what i want with multiple match functions

IS there anyway can i use those strings in a single 'like' or 'match' function?

like below:
case( match(ALERTDESCRIPTION,"(FILEtest_file)") | ("For transaction Login . 3 out of 3 transactions failed%, ), "Global FIle Issue"

0 Karma

SplunkTrust
SplunkTrust

can I see your entire search query?

0 Karma

Explorer

index="mdata" sourcetype="uat:tables"
| fillnull value="Unknown"
| search SIG
TEAMNAME IN ("*" , "TESTAPP") ALERTDESCRIPTION IN ("") ALERT_ID IN ("") ALERTSUPPORTGROUP IN ("TESTAPP")
| dedup ALERT
ID
| rex "KBList\":\"(?[^\"]+)"
| table SIG
ID ALERTID SIGENVIRONMENT ALERTHOSTNAME ALERTINSTANCE KBList ISSUETYPE ALERTDESCRIPTION SIGDESCRIPTION ALERTSTATUS ALERTSUPPORTGROUP ALERTFIRSTEVENTTIME ALERTLASTEVENTTIME
| sort ALERTID
|eval ISSUE
TYPE=case( match(ALERTDESCRIPTION,"(FILEtest_file)") | ("For transaction Login . 3 out of 3 transactions failed%, ), "Global FIle Issue"

0 Karma

Explorer

| eval ISSUETYPE=case( match(ALERTDESCRIPTION,"(FILEtestfile)") | ("For transaction Login . 3 out of 3 transactions failed%, ), "Global FIle Issue"
@mayurr98

0 Karma