Splunk Search

Regexing multiple values

WestlyB
New Member

Hello everyone,

I've been banging my head on this one. I'm sure it involves 'rex' which I'm not so familiar with.

I have the following search
search | regex _raw="|MAX TCP Connections||MAX UDP Connections|" | table _raw

Of course this spits out the entire _raw event. I'd like search for all events that match event with either MAX TCP Connection or MAX UDP Connection and send those to a field and when I use table, I see either MAX TCP Connections or MAX UDP Connections in the field. No event will have both. I really hope that makes sense. Any help would be great.

Tags (1)
0 Karma

somesoni2
Revered Legend

Please provide some sample data and expected final output.

0 Karma

the_wolverine
Champion
"MAX TCP Connections" OR "MAX UDP Connections" | rex "(?<value>(MAX TCP Connections|MAX UDP Connections)" | stats count by value

WestlyB
New Member

Thanks for the reply! but this didn't work for me. 😞

0 Karma

the_wolverine
Champion

The match is case sensitive so edit as needed to exact match the string you are looking for.

0 Karma

MuS
Legend

Maybe add a max_match=0 to the regex or to make it case insensitive add (?i) to the regex like this rex "(?<value>(?i)(MAX TCP Connections|MAX UDP Connections)" and remember - this is un-tested since I have no Splunk instance handy right now 😉

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...