Splunk Search

Regex to extract a word after word and comma

dtccsundar
Path Finder

i have 2 requirements 

1) From different events in need to extract the word after Interface  and Comma. After Interface there will be a space .Field name can be Interface

2) Need to extract a new field with name Activity with values either Up or Down .I have marked in bold in the events .

Ex- 

1) Mar 5 05:45:43 ie-dub-corp-sw1 Eastern: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/0/19, changed state to down

2) Mar 5 05:46:50 omenmnlswfl02 EST: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/3, changed state to up

Please help me with 2 regex .

 

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dtccsundar,

if you want only one regex, you can use

| rex "Interface\s+(?<interface>[^,]+), changed state to (?<state>\w+)"

if you prefer two regexes, you can use:

| rex "Interface\s+(?<interface>[^,]+)"
| rex ""changed state to (?<state>\w+)"

you can test the regx at https://regex101.com/r/WpmBG3/1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...