Splunk Search

Rex for different pattern of same fields within same event

sh254087
Communicator

Trying to formulate a Regex that would work with events something like the below one. When I tried extracting the fields, I did not get to the expected output as the field name I'm looking at is same for values of different pattern. The rex was either failing or throwing error about using duplicate field name.

Sample Event entry:
No machines for project Print-Demo
No machines for project Kimkeen_POC
No machines for project Default Project
Project name: ABCD Life, Machine name:hlstocpra2, Status:STARTED, Backlog bytes:0, Last consistency:Still replicating
Project name: ABCD Life, Machine name:HKWONDERSVD02, Status:PAUSED, Backlog bytes:0, Last consistency:Still replicating
Project name: ABCD Life, Machine name:hlstocpraw2, Status:PAUSED, Backlog bytes:0, Last consistency:Still replicating
No machines for project Print
No machines for project Demo2
No machines for project Test_migrate

Expected extraction and output:
alt text

Looking for help in extracting the fields with all the values to be presented in individual rows.

0 Karma

wenthold
Communicator

I'm not sure if you should use a more complex single rex command, but you can:

| rex "[Pp]roject (?:name: )?(?<ProjectName>[^\,\r\n]+)(?:\, Machine name\:(?<MachineName>[^\,]+)\, Status\:(?<JobStatus>[^\,]+)\, Backlog bytes\:(?<BacklogBytes>[0-9]+)\, Last consistency\:(?<LastConsistency>.*))?"
| table ProjectName, MachineName, JobStatus, BacklogBytes, LastConsistency
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi sh254087,
I suggest to use two different regexes, one for No machines and one for machines the merge machine name fields using coalesce, in othe words:

| rex "(No machines for project )(?<Project_Name1>.*)"
| rex "(?ms)Project name: (?<Project_Name2>[^,]*), Machine name:(?<Machine_Name>[^,]*), Status:(?<Status>[^,]*), Backlog bytes:(?<Backlog_bytes>[^,]*)"
| eval Project_name=coalesce(Project_name1,Project_name2)

you can test it at https://regex101.com/r/X3pgrK/2

Bye.
Giuseppe

0 Karma

sh254087
Communicator

Please help @niketnilay
@shwetas

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...