Splunk Search

RegEx Extract value after string

arrowecssupport
Communicator

I'm trying to build an extraction to find the uptime from this data (example below)

.1.3.6.1.4.1.789 Enterprise Specific Trap (87) Uptime: 0:27:51.35
.1.3.6.1.3.94 Enterprise Specific Trap (4) Uptime: 195 days, 7:01:04.00

Can anyone help with the RegEx?

Tags (1)
0 Karma
1 Solution

niketnilay
Legend

@arrowecssupport, based on the sample data you can use the following rex command:

| rex "Uptime:\s(?<uptime>.*)"

Please find below the tun anywhere search, which extracts the uptime value and also uses convert command function dur2sec() to convert D+HH:MM:SS to seconds.

| makeresults
| eval data=".1.3.6.1.4.1.789 Enterprise Specific Trap (87) Uptime: 0:27:51.35;.1.3.6.1.3.94 Enterprise Specific Trap (4) Uptime: 195 days, 7:01:04.00"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| rex "Uptime:\s(?<uptime>.*)"
| eval uptime_seconds=replace(replace(uptime,"\sdays,\s","+"),"\..+","")
| convert dur2sec(uptime_seconds)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketnilay
Legend

@arrowecssupport, based on the sample data you can use the following rex command:

| rex "Uptime:\s(?<uptime>.*)"

Please find below the tun anywhere search, which extracts the uptime value and also uses convert command function dur2sec() to convert D+HH:MM:SS to seconds.

| makeresults
| eval data=".1.3.6.1.4.1.789 Enterprise Specific Trap (87) Uptime: 0:27:51.35;.1.3.6.1.3.94 Enterprise Specific Trap (4) Uptime: 195 days, 7:01:04.00"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| rex "Uptime:\s(?<uptime>.*)"
| eval uptime_seconds=replace(replace(uptime,"\sdays,\s","+"),"\..+","")
| convert dur2sec(uptime_seconds)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!