Solved: Regular expression only one value

leandromatperei · ‎08-11-2020

Dear, I need to identify some duplicate events that are right after the "Call-ID:", however in Splunk I am not getting him to identify this field:

index=teste "*CALL-ID*" :

Aug 11 14:50:42 10.178.214.7 1 2020-08-11T14:50:41.979000-03:00 localhost GroupSeries - - [NXLOG@14506 EventReceivedTime="2020-08-11 14:50:42" SourceModuleName="plcmlog" SourceModuleType="im_file"] CEng: SIPMSG: Call-ID: 2932867290-4209

Aug 11 14:50:34 10.53.96.71 1 2020-08-11T14:50:25.326000-03:00 G7500-4D2120F2 GroupSeries - - [NXLOG@14506 EventReceivedTime="2020-08-11 14:50:34" SourceModuleName="plcmlog" SourceModuleType="im_file"] CEng: SIPMSG: Call-ID: 1112255280-4006

Aug 11 14:50:34 10.53.96.71 1 2020-08-11T14:50:25.080000-03:00 G7500-4D2120F2 GroupSeries - - [NXLOG@14506 EventReceivedTime="2020-08-11 14:50:34" SourceModuleName="plcmlog" SourceModuleType="im_file"] CEng: SIPMSG: Call-ID: 1112255280-4006

thambisetty · ‎08-11-2020

| rex “Call-ID:\s+(?<callid>.*)$”

value will be extracted to field callid

————————————
If this helps, give a like below.

View solution in original post

thambisetty · ‎08-11-2020

| rex “Call-ID:\s+(?<callid>.*)$”

value will be extracted to field callid

————————————
If this helps, give a like below.

Regular expression only one value

regex

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation