Splunk Search

Rex query

harishnpandey
Explorer

For below input I tried search query as

index=myindex "Notification"|rex "(MQ) (?\d+) = (?\w+)"|stats count(Notification)
However, its not working says "no result found". The moment I take off ==> stats count(Notification)
it shows values

Input:
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = EMAIL
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = SMS
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = VOICE
Output

Notification Type TypeCode
MQ EMAIL
MQ SMS
MQ VOICE

Tags (1)
0 Karma
1 Solution

DalJeanis
Legend

Okay, reading what I can read, i don't see why it would succeed.

Your rex is looking for a decimal number after (MQ) and before the =, which is not in your data.

Something like this should pull the two fields...

| rex "Notification Type \((?<NotifType>[^\)]*)\) = (?<TypeCode>\w+)"

View solution in original post

0 Karma

DalJeanis
Legend

Okay, reading what I can read, i don't see why it would succeed.

Your rex is looking for a decimal number after (MQ) and before the =, which is not in your data.

Something like this should pull the two fields...

| rex "Notification Type \((?<NotifType>[^\)]*)\) = (?<TypeCode>\w+)"
0 Karma

harishnpandey
Explorer

Thank you Jean. I figured out my mistake with your help :slightly_smiling_face:

somesoni2
Revered Legend

You query is truncated. Please edit the question to add the query again and ensure that you select the query and click on button "101010" OR press Ctrl+K to format the code (to retains all formatting/content). Do the same for your raw data and output

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...