Splunk Search

RegEx How to find two strings from splunk log

dabroma5
Explorer

I have below log:

Service ABCD(blabla_blabla): 365.45.1.87.3.60354 -> remote.234.5 Failure
Service DERF(blabla_blabla): remote.567.9 -> remote.284.9 Failure

and would like to catch with RegEx:

a: 365.45.1.87.3.60354 b: remote.234.5

a: remote.567.9 b: remote.284.9

Thanks for help

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @dabroma5
try this regex:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)"

that you can test at https://regex101.com/r/fOwXfs/1

if eventually you have some false positive, you could also try:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)\s+Failure"

that you can test at https://regex101.com/r/fOwXfs/2

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @dabroma5
try this regex:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)"

that you can test at https://regex101.com/r/fOwXfs/1

if eventually you have some false positive, you could also try:

| rex ":\s+(?<a>[^ ]+)\s+-\>\s+(?<b>[^ ]+)\s+Failure"

that you can test at https://regex101.com/r/fOwXfs/2

Ciao.
Giuseppe

efavreau
Motivator

@gcusello your response was crazy fast! Awesome!

###

If this reply helps you, an upvote would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dabroma5
you're welcome!
Ciao and next time.
Giuseppe

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval log="Service ABCD(blabla_blabla): 365.45.1.87.3.60354 -> remote.234.5 Failure#Service DERF(blabla_blabla): remote.567.9 -> remote.284.9 Failure" 
| eval temp=split(log,"#") 
| mvexpand temp 
| rex field=temp "\:\s+(?P<a>[^->]+)\s+->\s+(?P<b>\S+)" 
| table a b
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...