Hi All,
need help in 2 regex problem.
1. Filtering Class_Type value from the _raw .
"Ticket_ID": "8158",
Please see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nTHPSL- : Node is down.\nClass: NodeDown Trap\nHost: THPSL-\nAlertID: 46141249\nSource Tool: OpenNMS\n-------------------------\nThe Moogsoft situation id = 999790\n\nSituationID from Moogsoft = https://moogui.na.xom.com/#/situation/999790
I use below regex which worked in https://regex101.com/ , but am not getting the exact output in splunk query
| rex field=_raw "Class:\s(?<Class_Type>[^\\]+)"
2. _raw having 2 Class_Type field.
""Ticket_ID"": ""1395"",
Please see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nPGPLNGH1- : Node is down.\nClass: NodeDown Trap\nHost: PGPLNGH1-\nAlertID: 45744967\nSource Tool: OpenNMS\n-------------------------\nPlease see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nPGPLNGH4-: Operational status Down on interface ifname:Gi0/28 ifindex:10128 ifdescr:GigabitEthernet0/28 ifalias:iLi to PGPLNGH1-:Gi0/28\nClass: Custom Trap\nHost: PGPLNGH4-\nAlertID: 45748120\nSource Tool: OpenNMS\n-------------------------\nThe Moogsoft situation id = 973750\n\nSituationID from Moogsoft = https://moogui.na.xom.com/#/situation/973750"
how can i get both Class_Type field in Splunk output.
Sample output.
Class_Type |
Custom Trap |
NodeDown Trap |
Hi
please try to add one more \ to your regexp
| rex field=_raw "Class:\s(?<Class_Type>[^\\\]+)"
And for second case add max_match=0 after field=_raw
r. Ismo
Hi
please try to add one more \ to your regexp
| rex field=_raw "Class:\s(?<Class_Type>[^\\\]+)"
And for second case add max_match=0 after field=_raw
r. Ismo