Splunk Search

RegEx How to find two strings from splunk log

dabroma5
Explorer

I have below log:

Service ABCD(blabla_blabla): 365.45.1.87.3.60354 -> remote.234.5 Failure
Service DERF(blabla_blabla): remote.567.9 -> remote.284.9 Failure

and would like to catch with RegEx:

a: 365.45.1.87.3.60354 b: remote.234.5

a: remote.567.9 b: remote.284.9

Thanks for help

0 Karma
1 Solution

gcusello
Legend

Hi @dabroma5
try this regex:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)"

that you can test at https://regex101.com/r/fOwXfs/1

if eventually you have some false positive, you could also try:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)\s+Failure"

that you can test at https://regex101.com/r/fOwXfs/2

Ciao.
Giuseppe

View solution in original post

gcusello
Legend

Hi @dabroma5
try this regex:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)"

that you can test at https://regex101.com/r/fOwXfs/1

if eventually you have some false positive, you could also try:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)\s+Failure"

that you can test at https://regex101.com/r/fOwXfs/2

Ciao.
Giuseppe

efavreau
Motivator

@gcusello your response was crazy fast! Awesome!

###

If this reply helps you, an upvote would be appreciated.
0 Karma

gcusello
Legend

Hi @dabroma5
you're welcome!
Ciao and next time.
Giuseppe

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval log="Service ABCD(blabla_blabla): 365.45.1.87.3.60354 -> remote.234.5 Failure#Service DERF(blabla_blabla): remote.567.9 -> remote.284.9 Failure" 
| eval temp=split(log,"#") 
| mvexpand temp 
| rex field=temp "\:\s+(?P<a>[^->]+)\s+->\s+(?P<b>\S+)" 
| table a b
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...