Splunk Search

RegEx or Field Transformation ?

righettod
Engager

Hello,

I have an event that have this format:

[13/01/31@00:14:05.269+0100] P-1770312 T-000001 1 AS -- (Procedure: 'put-one-message llwks.c' Line:1610) ** Attempt to write to closed stream swk-log. (1387)

I try to find (since some days ago) a RegEx expression in order to extract the value "1387" but without selecting the "()" in the target extracted value.

Is it possible to achieve this by RegEx or must I use Field Transformation ?

Thanks in advance for your helps ;o)))

Dominique

Tags (1)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

You actually don't need transforms, you could put the following into props.conf on the search head (remove the \ that precedes the word MyField, I had to put that in there for formatting purposes):

EXTRACT-field = (?<\MyField>\d+)\)$

This would go in the stanza for the source/sourcetype in question.

View solution in original post

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

You actually don't need transforms, you could put the following into props.conf on the search head (remove the \ that precedes the word MyField, I had to put that in there for formatting purposes):

EXTRACT-field = (?<\MyField>\d+)\)$

This would go in the stanza for the source/sourcetype in question.

0 Karma

wpreston
Motivator

How about something like this? You may need to customize it further to match other samples of your data.

...your search... | rex "[(](?<MyField>\d+)[)]"

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...