2011-11-07 13:25:35,145
2011-11-07 13:25:35,152
2011-11-07 13:25:35,158
2011-11-07 13:25:35,160
2011-11-07 13:25:39,976
2011-11-07 13:25:41,386
2011-11-07 13:39:14,750
2011-11-07 13:39:16,139
2011-11-07 13:49:27,829
2011-11-07 13:49:27,838
2011-11-07 13:49:27,868
2011-11-07 13:49:27,869
2011-11-07 13:49:27,982
2011-11-07 13:49:29,524
2011-11-07 13:58:19,630
2011-11-07 13:58:20,147
In the above log I only to search for log lines that has K and ends with initialized or destroyed. So my search result should be
2011-11-07 13:25:35,158
2011-11-07 13:25:41,386
2011-11-07 13:49:27,868
2011-11-07 13:49:29,524
What might be the possible search query??
I noticed that you missed a "\" in your last comment in front of the first "s+". I tested the regex with your data and it worked. Make sure that your search is similar to the following:
sourcetype=system | rex field=_raw "\<kernel\>\s+(?<message>[^$]+)$" | search (message="*initialized" OR message="*destroyed")
Did you replace the sourcetype=
sourcetype=system | rex field=_raw "\<kernel\>\s+(?<message>[^$]+)$" | search (message="*initialized" OR message="*destroyed")
You can also replace the sourcetype with either the source or host for instance, ie:
source=kernel.log | rex field=_raw "\<kernel\>\s+(?<message>[^$]+)$" | search (message="*initialized" OR message="*destroyed")
host=mysystem123 | rex field=_raw "\<kernel\>\s+(?<message>[^$]+)$" | search (message="*initialized" OR message="*destroyed")
Problem is with this rex field=_raw "<kernel>\s+(?
Maybe this would work but I am not sure what your field extraction is looking like:
sourcetype=<yoursourcetype> | rex field=_raw "\<kernel\>\s+(?<message>[^$]+)$" | search (message="*initialized" OR message="*destroyed")
It didn't work..didn't return anything at all