Splunk Search

Specific rex doesnt seem to work

clintla
Contributor

Have 3 sets of drives that are listed differently by different systems.

FC SSD

SATAII SSD

Fibre Channel

SATAII

Really its just SATA, Fibre Channel & SSD & I'd like to group them as such.

I've tried many variations of

"Drive\sType:\s+(?<drive_tier>Fibre|SATAII\\s\\s|/SSD/)"

The above SHOULD work IMO. but it only lists the first 2. I've tried many
variations & either it finds the first 2 or lists all 4.

If I take out the \s\s on the plain SATA then it will group the SATA SSD's
with it- its not what I want but its the only grouping I've been able to
see with this. The 2 SATAII's seem to make this a little more difficult.

Anyone have any suggestions to try?

Tags (1)
0 Karma
1 Solution

Paolo_Prigione
Builder

Here you go:

"Drive Type: (?:SATAII |FC )*(?<drive_tier>Fibre|SATAII(?! SSD)|SSD)"

Results:

  • Drive Type: SATAII SSD --> SSD
  • Drive Type: SATAII --> SATAII
  • Drive Type: Fibre Channel --> Fibre
  • Drive Type: FC SSD --> SSD

There's no way to have it output an uppercase "FIBRE" as regexes only output what was in the original text.

View solution in original post

Paolo_Prigione
Builder

Here you go:

"Drive Type: (?:SATAII |FC )*(?<drive_tier>Fibre|SATAII(?! SSD)|SSD)"

Results:

  • Drive Type: SATAII SSD --> SSD
  • Drive Type: SATAII --> SATAII
  • Drive Type: Fibre Channel --> Fibre
  • Drive Type: FC SSD --> SSD

There's no way to have it output an uppercase "FIBRE" as regexes only output what was in the original text.

malberto
Explorer
  1. Why are you doing "\s" in one place and "\s" in another!

  2. Why do you have "SATAII\s\s" when sometimes you have "SATAII" and sometimes "SATA SSD". Your regex will match either. You want: "...|SATAII|..."

  3. It seems to be that what you REALLY want is just:

    "Drive\sType:\s+(?.+?)$"

Any DriveType until the newline.

clintla
Contributor

SATAII & SATAII SSD are separate. I want those 2
Fibre SSD & SATAII SSD's to be grouped togather.

When I put in the \s\s it separated SATAII vs. SATA SSD.

I thought if I had |SSD that it would pickup anything
that had SSD in the string.. seems like a nice idea- but
it doesnt work

0 Karma

clintla
Contributor

Drive Type: FC SSD

Drive Type: Fibre Channel

Drive Type: SATAII

Drive Type: SATAII SSD

Above is exacltly the way they appear.
I'd like to just have 3 groups.

SATAII

SSD (the 2 SSD's combined)

FIBRE

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

could you post an example of some events that you'd like to apply the rex to so we can get an idea of the format for the events?

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...