Splunk Search

Splunk search regex how to??

New Member

from this string 'op-failed', 'text': "[Errno 2] bad format", 'time': 1355388330.578211, 'error': 'fetch-error'}
how can I extract the text between 'text' and 'time'?

I'm looking for a regex that would return [Errno 2] bad format

Thanks

Tags (2)
0 Karma

Legend

This should do it

'text:'\s*"(?<errorText>.*?)"

If you need to put in the rex command, you could use

\'text:\'\s*\"(?<errorText>.*?)\"

Otherwise the quotation marks may confuse the search parser.

Note that the resulting field is named errorText

0 Karma

Legend

You could do a search like this

sourcetype="worker-stderr-*" op-failed "[Errno 2] bad format"

0 Karma

Legend

Okay, the original question said that you wanted a regex that would extract a value. In Splunk terms, you are asking for a field: a field is defined by a regex and has a value based on what is extracted from the events. A regex that defines a field could be used with the rex command, or it could be used with the interactive field extractor.

If what you want is a search, then you need to edit your question. What exactly do you want to accomplish? I am not sure now that you need to use a regular expression at all.

0 Karma

New Member

this search query returns 0 items
sourcetype="worker-stderr-*" op-failed | regex _raw=\'text:\'\s*\"(?<errorText>.*?)\"

this search query returns 10 items
sourcetype="worker-stderr-*" op-failed

is this what you had in mind or am I missing something.
Thanks

0 Karma

New Member

How would the search query look like? (sorry I'm new to splunk)

the source type is sourcetype="worker-stderr-*"

Thanks.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!