Simple regex problem

[neilstuartcraig]

Hi all

I have hit a problem with Splunk which I am hoping someone might be able to offer some help with. I've just written a search which aims to collate IIS crashes to provide an overview of number of crashes versus hour of the day so i can see if there are any regular patterns.

The regex seems to work fine but i can't cluster on the fields extracted by the regex - i have previously done this successfully. Any ideas? My search is:

host="*" earliest_time=-30d sourcetype="WinEventLog:Application" | search Message="Faulting application name: w3wp.exe*" | 
rex field=_raw "(?<i_month>\d{1,2})\/(?<i_date>\d{1,2})\/(?<i_year>\d{2,4}) (?<i_hours>\d{1,2}):(?<i_minutes>\d{1,2}):(?<i_seconds>\d{1,2}).*" | 
cluster field=i_hours t=0.99 countfield=numErrors 
| sort -numErrors | table numErrors i_hours

Many thanks
Neil

[lguinn2]

I am not sure of the answer to your rex problem, but I do have a suggestion for the search -

You may not need the rex. Splunk automatically creates a number of fields from your timestamp: date_mday, date_wday, date_month, date_hour

So your search could be

host="*" earliest_time=-30d sourcetype="WinEventLog:Application" | search Message="Faulting application name: w3wp.exe*" | 
cluster field=date_hour t=0.99 countfield=numErrors 
| sort -numErrors | table numErrors i_hours