Splunk Search

RegEx How to find two strings from splunk log

dabroma5
Explorer

I have below log:

Service ABCD(blabla_blabla): 365.45.1.87.3.60354 -> remote.234.5 Failure
Service DERF(blabla_blabla): remote.567.9 -> remote.284.9 Failure

and would like to catch with RegEx:

a: 365.45.1.87.3.60354 b: remote.234.5

a: remote.567.9 b: remote.284.9

Thanks for help

0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @dabroma5
try this regex:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)"

that you can test at https://regex101.com/r/fOwXfs/1

if eventually you have some false positive, you could also try:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)\s+Failure"

that you can test at https://regex101.com/r/fOwXfs/2

Ciao.
Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @dabroma5
try this regex:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)"

that you can test at https://regex101.com/r/fOwXfs/1

if eventually you have some false positive, you could also try:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)\s+Failure"

that you can test at https://regex101.com/r/fOwXfs/2

Ciao.
Giuseppe

efavreau
Motivator

@gcusello your response was crazy fast! Awesome!

###

If this reply helps you, an upvote would be appreciated.
0 Karma

gcusello
Esteemed Legend

Hi @dabroma5
you're welcome!
Ciao and next time.
Giuseppe

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval log="Service ABCD(blabla_blabla): 365.45.1.87.3.60354 -> remote.234.5 Failure#Service DERF(blabla_blabla): remote.567.9 -> remote.284.9 Failure" 
| eval temp=split(log,"#") 
| mvexpand temp 
| rex field=temp "\:\s+(?P<a>[^->]+)\s+->\s+(?P<b>\S+)" 
| table a b
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 1 release of new security content via the ...

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...