Splunk Search

Regular expression to extract http status

thenormalone
Path Finder

I have http statuses that come in from 2 different indexes, with almost the same event but the event from one indexer has a combination of space and comma as a delimiter and other just has spaces. 

How do I split the event from the search string such that I get the status from both indexes. I have 

| rex field=_raw "^(?:[^\s]*\s){8}(?P<statusCode>\d+)"  

 

but this only check for space, I need to also include comma as a delimiter too

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=_raw "^(?:[^\"]*\"){2}\s(?P<statusCode>\d+)"  

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Do you have examples of the two types of logs that you can share?

0 Karma

thenormalone
Path Finder

example from indexer 1: 

172.22.83.162 - - [10/Jul/2018:14:46:42 +0000] "GET /tests/benefits HTTP/1.1" 200 337 "-" "Ruby" 0

 

example from indexer 2: 

172.22.83.162 - - [10/Jul/2018:14:46:42,+0000] "GET /tests/benefits HTTP/1.1" 200 337 "-" "Ruby" 0

 

The timestamp has a comma instead of a space

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=_raw "^(?:[^\"]*\"){2}\s(?P<statusCode>\d+)"  
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...