Splunk Search

Rex not iterating over large string

evan_roggenkamp
Path Finder

I am trying to use rex to extract the hostnames and put them in a table, but rex is only matching the first string and then it stops

rex "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name

The data is part of a job log I am ingesting files and directories input.

The textfile is formatted like this:

___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.mrcl1.domain.net (10.140.255.7):
 ERROR: Cannot download Running config : Connection Refused by 10.140.255.7
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.abvl1.domain.net (10.252.255.50):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.blvw1.domain.net (10.196.255.5):
downloaded Running config
__________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.clem1.domain.net (10.196.255.1):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.domain.net (10.140.255.9):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.drck1.domain.net (10.132.255.3):
downloaded Running config
___________________________________________________________________________

I did have to clean this file up with python before getting it into splunk, so if some kind of text operation/reorganization would help this go more smoothly that is definitely an option.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The rex command by default matches only one. Use max_matchoption to increase that limit

 ...| rex max_match=100 "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name

View solution in original post

gcusello
SplunkTrust
SplunkTrust

try this

HOSTNAME:\s+(?<myfield>[^ ]+)/g

you can test it on https://regex101.com/
Bye.
Giuseppe

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The rex command by default matches only one. Use max_matchoption to increase that limit

 ...| rex max_match=100 "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...