Splunk Search

Regex field help

Path Finder

Hi All,

need help in 2 regex problem.

1. Filtering Class_Type value from the  _raw .

 

"Ticket_ID": "8158",
Please see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nTHPSL- : Node is down.\nClass: NodeDown Trap\nHost: THPSL-\nAlertID: 46141249\nSource Tool: OpenNMS\n-------------------------\nThe Moogsoft situation id = 999790\n\nSituationID from Moogsoft = https://moogui.na.xom.com/#/situation/999790

 

  I use below regex which worked in https://regex101.com/  , but am not getting the exact output in splunk query

| rex field=_raw "Class:\s(?<Class_Type>[^\\]+)"

 

2. _raw having 2 Class_Type field.

 

""Ticket_ID"":  ""1395"",
Please see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nPGPLNGH1- : Node is down.\nClass: NodeDown Trap\nHost: PGPLNGH1-\nAlertID: 45744967\nSource Tool: OpenNMS\n-------------------------\nPlease see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nPGPLNGH4-: Operational status Down on interface ifname:Gi0/28 ifindex:10128 ifdescr:GigabitEthernet0/28 ifalias:iLi to PGPLNGH1-:Gi0/28\nClass: Custom Trap\nHost: PGPLNGH4-\nAlertID: 45748120\nSource Tool: OpenNMS\n-------------------------\nThe Moogsoft situation id = 973750\n\nSituationID from Moogsoft = https://moogui.na.xom.com/#/situation/973750"

 

  how can i get both Class_Type field in Splunk output.

Sample output.

Class_Type
Custom Trap
NodeDown Trap
Labels (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi

please try to add one more \ to your regexp

| rex field=_raw "Class:\s(?<Class_Type>[^\\\]+)"

And for second case add max_match=0 after field=_raw

r. Ismo 

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi

please try to add one more \ to your regexp

| rex field=_raw "Class:\s(?<Class_Type>[^\\\]+)"

And for second case add max_match=0 after field=_raw

r. Ismo 

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!