Regex field help

[jerinvarghese]

Hi All,

need help in 2 regex problem.

1. Filtering Class_Type value from the  _raw .

"Ticket_ID": "8158",
Please see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nTHPSL- : Node is down.\nClass: NodeDown Trap\nHost: THPSL-\nAlertID: 46141249\nSource Tool: OpenNMS\n-------------------------\nThe Moogsoft situation id = 999790\n\nSituationID from Moogsoft = https://moogui.na.xom.com/#/situation/999790

  I use below regex which worked in https://regex101.com/  , but am not getting the exact output in splunk query

| rex field=_raw "Class:\s(?<Class_Type>[^\\]+)"

2. _raw having 2 Class_Type field.

""Ticket_ID"":  ""1395"",
Please see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nPGPLNGH1- : Node is down.\nClass: NodeDown Trap\nHost: PGPLNGH1-\nAlertID: 45744967\nSource Tool: OpenNMS\n-------------------------\nPlease see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nPGPLNGH4-: Operational status Down on interface ifname:Gi0/28 ifindex:10128 ifdescr:GigabitEthernet0/28 ifalias:iLi to PGPLNGH1-:Gi0/28\nClass: Custom Trap\nHost: PGPLNGH4-\nAlertID: 45748120\nSource Tool: OpenNMS\n-------------------------\nThe Moogsoft situation id = 973750\n\nSituationID from Moogsoft = https://moogui.na.xom.com/#/situation/973750"

  how can i get both Class_Type field in Splunk output.

Sample output.

Class_Type

Custom Trap

NodeDown Trap

[isoutamo · Accepted solution]

Hi

please try to add one more \ to your regexp

| rex field=_raw "Class:\s(?<Class_Type>[^\\\]+)"

And for second case add max_match=0 after field=_raw

r. Ismo