Splunk Search

Rex multiple strings from field query

New Member

Morning all,

I hope this is an easy one where i am just missing some login somewhere.

I have a field called errors that houses data that looks like this:

*Fieldname *



This is indicating that a single event can incur multiple errors and i need to pull all the error codes separately (codes are always numerical and always 5 digits long).

The colon and digits after indicate count volumes which are irrelevant and the delimiter is always a semi-colon.

This seems quite an easy pull as the rex is simply "(\d\d\d\d\d):"

However i can't get splunk to spit anything out at all (and ive tried lots of variations).

Ideally i want to stats value the result by user so i end up with something like the below:

user1 56005
User2 66095

any ideas?:

Tags (1)
0 Karma




|rex field=errors max_match=0 "(?<Errors>\d{5}):"
Happy Splunking!
0 Karma

New Member

current search = | rex field=errors "(?(\d\d\d\d\d):)"

0 Karma

New Member

this will give back the first rex entry only, so i need a way to reproduce and collect an unlimited amount of REX groups.. (each string may contain from 1 to 1000 codes).

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...