Splunk Search

Regular expression to extract http status

thenormalone
Path Finder

I have http statuses that come in from 2 different indexes, with almost the same event but the event from one indexer has a combination of space and comma as a delimiter and other just has spaces. 

How do I split the event from the search string such that I get the status from both indexes. I have 

| rex field=_raw "^(?:[^\s]*\s){8}(?P<statusCode>\d+)"  

 

but this only check for space, I need to also include comma as a delimiter too

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=_raw "^(?:[^\"]*\"){2}\s(?P<statusCode>\d+)"  

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Do you have examples of the two types of logs that you can share?

0 Karma

thenormalone
Path Finder

example from indexer 1: 

172.22.83.162 - - [10/Jul/2018:14:46:42 +0000] "GET /tests/benefits HTTP/1.1" 200 337 "-" "Ruby" 0

 

example from indexer 2: 

172.22.83.162 - - [10/Jul/2018:14:46:42,+0000] "GET /tests/benefits HTTP/1.1" 200 337 "-" "Ruby" 0

 

The timestamp has a comma instead of a space

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=_raw "^(?:[^\"]*\"){2}\s(?P<statusCode>\d+)"  
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...