Splunk Search

Why is my regex not matching?

michaelnorup
Communicator

My regex from the message field looks like this.

 

| rex field=Message "\W(?<Hostname>\S+)\s\w+\W(?<Build>\S+)\s\w+\W(?<CpuCount>\S+)\s\w+\W(?<CpuTotalMhz>\S+)\s\w+\W(?<CpuUsageMhz>\S+)\s\w+\W(?<MemoryTotalMB>\S+)\s\w+\W(?<MemoryUsageMB>\S+)\s\w+\W(?<Version>\S+)" |

 


For some reason it matches and pulls out all the fields from this entry:

 

Message=Hostname=esx-pod1-nprd-112.mad.local Build=20842708 CPUCount=96 CpuTotalMhz=287232 CpuUsageMhz=142 MemoryTotalMB=1048094.5625 MemoryUsageMB=9086 Version=7.0.3

 


But not from any other entries which could looks like this:

 

Message=Hostname=10.241.192.46 Build=20842708 CPUCount=96 CpuTotalMhz=287232 CpuUsageMhz=8186 MemoryTotalMB=1048094.55859375 MemoryUsageMB=198624 Version=

 

or 

 

Message=Hostname=esx-cl6-184.mad.local Build=19195723 CPUCount=20 CpuTotalMhz=49880 CpuUsageMhz=672 MemoryTotalMB=294587.2578125 MemoryUsageMB=52530 Version=

 

Labels (1)
0 Karma
1 Solution

michaelnorup
Communicator

It was because "Version" was empty. Fixed that in the script that populated the fields outside of splunk

View solution in original post

0 Karma

michaelnorup
Communicator

It was because "Version" was empty. Fixed that in the script that populated the fields outside of splunk

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Gr0und_Z3r0 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors :winking_face:

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @michaelnorup ,

please try this regex:

| rex field=Message "Hostname\=(?<Hostname>[^ ]*)\s+Build\=(?<Build>[^ ]*)\s+CPUCount\=(?<CPUCount>[^ ]*)\s+CpuTotalMhz\=(?<CpuTotalMhz>[^ ]*)\s+CpuUsageMhz\=(?<CpuUsageMhz>[^ ]*)\s+MemoryTotalMB\=(?<MemoryTotalMB>[^ ]*)\s+MemoryUsageMB\=(?<MemoryUsageMB>[^ ]*)\s+Version\=(?<Version>.*)"

Ciao.

Giuseppe 

0 Karma

Gr0und_Z3r0
Contributor

hi @michaelnorup 

Try this...

| makeresults
| eval Message="Hostname=esx-pod1-nprd-112.mad.local Build=20842708 CPUCount=96 CpuTotalMhz=287232 CpuUsageMhz=142 MemoryTotalMB=1048094.5625 MemoryUsageMB=9086 Version=7.0.3,Hostname=10.241.192.46 Build=20842708 CPUCount=96 CpuTotalMhz=287232 CpuUsageMhz=8186 MemoryTotalMB=1048094.55859375 MemoryUsageMB=198624 Version=,Hostname=esx-cl6-184.mad.local Build=19195723 CPUCount=20 CpuTotalMhz=49880 CpuUsageMhz=672 MemoryTotalMB=294587.2578125 MemoryUsageMB=52530 Version="
| makemv Message delim=","
| mvexpand Message
| rex field=Message "Hostname\=(?<Hostname>[\w\-\.]+)\sBuild\=(?<Build>[\d]+)\sCPUCount\=(?P<CPUCount>[\d]+)\sCpuTotalMhz\=(?P<CpuTotalMhz>[\d]+)\sCpuUsageMhz\=(?P<CpuUsageMhz>[\d]+)\sMemoryTotalMB\=(?P<MemoryTotalMB>[\d\.]+)\sMemoryUsageMB\=(?P<MemoryUsageMB>[\d\.]+)\sVersion\=(?P<Version>.*)" 
| table Message Hostname Build CPUCount CpuTotalMhz CpuUsageMhz MemoryTotalMB MemoryUsageMB Version

Gr0und_Z3r0_0-1679997748717.png


~ If the reply helps a karma vote would be appreciated

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...