Splunk Search

Regex field help

Path Finder

Hi All,

need help in 2 regex problem.

1. Filtering Class_Type value from the  _raw .

 

"Ticket_ID": "8158",
Please see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nTHPSL- : Node is down.\nClass: NodeDown Trap\nHost: THPSL-\nAlertID: 46141249\nSource Tool: OpenNMS\n-------------------------\nThe Moogsoft situation id = 999790\n\nSituationID from Moogsoft = https://moogui.na.xom.com/#/situation/999790

 

  I use below regex which worked in https://regex101.com/  , but am not getting the exact output in splunk query

| rex field=_raw "Class:\s(?<Class_Type>[^\\]+)"

 

2. _raw having 2 Class_Type field.

 

""Ticket_ID"":  ""1395"",
Please see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nPGPLNGH1- : Node is down.\nClass: NodeDown Trap\nHost: PGPLNGH1-\nAlertID: 45744967\nSource Tool: OpenNMS\n-------------------------\nPlease see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nPGPLNGH4-: Operational status Down on interface ifname:Gi0/28 ifindex:10128 ifdescr:GigabitEthernet0/28 ifalias:iLi to PGPLNGH1-:Gi0/28\nClass: Custom Trap\nHost: PGPLNGH4-\nAlertID: 45748120\nSource Tool: OpenNMS\n-------------------------\nThe Moogsoft situation id = 973750\n\nSituationID from Moogsoft = https://moogui.na.xom.com/#/situation/973750"

 

  how can i get both Class_Type field in Splunk output.

Sample output.

Class_Type
Custom Trap
NodeDown Trap
Labels (2)
0 Karma
1 Solution

Champion

Hi

please try to add one more \ to your regexp

| rex field=_raw "Class:\s(?<Class_Type>[^\\\]+)"

And for second case add max_match=0 after field=_raw

r. Ismo 

View solution in original post

0 Karma

Champion

Hi

please try to add one more \ to your regexp

| rex field=_raw "Class:\s(?<Class_Type>[^\\\]+)"

And for second case add max_match=0 after field=_raw

r. Ismo 

View solution in original post

0 Karma