Splunk Search

field extraction a specific match in a field

davidbarat
New Member

Hello,

I have an issue with this type of log :

[5/22/20 14:46:23:381 GMT] 0000009c ThreadMonitor 3 UsageInfo[ThreadPool:hung/active/size/max]={server.startup:0/0/1/3,ProcessDiscovery:0/0/1/2,TCPChannel.DCS:0/2/4/20,HAManager.thread.pool:0/0/2/2,Default:0/2/6/20}

I create a regex which works :

rex field=_raw "\[(?[^\[]*)\]\s(?[^\s]*)\s(?[^\s]*)\s(?[^\s]*)\s(?.{11})(?\[\w.*\])(?[\=])\{((?\w.*?):(?\d+)\/(?\d+)\/(?\d+)\/(?\d+))+"                                                                                                                                                 | table timestamp threadname hung max

But the threadname is always the first match, in my case server.startup.

Is it possible to add a where clause to extract the desired threadname, for example HAManager ?
And I can't modify props.conf because I don't have admin right.

Thanks for your help

David

Labels (5)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

1) Always mark your code so HTML-like aspects <threadname>don't get stripped out by the forum.

2) If you want to find all matches, use the max_match=0 parameter to get all matches for your rex.

3) if you are looking for only the value of a fixed name like HAManager.thread.pool:0/0/2/2,, then just use that name as your rex.

| rex field=_raw "HAManager.thread.pool:(?<threadpoolvalue>[^,]+)"

4) If you are looking for ALL values, then rex JUST the relevant matchable items.

| rex field=_raw max-match=0 "\b(?<threadpoolname>[^:]+):(?<threadpoolvalue>\d+\/\d+\/\d+\/\d+)\b"

Those are aircode, so they may require some adjustment.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) Always mark your code so HTML-like aspects <threadname>don't get stripped out by the forum.

2) If you want to find all matches, use the max_match=0 parameter to get all matches for your rex.

3) if you are looking for only the value of a fixed name like HAManager.thread.pool:0/0/2/2,, then just use that name as your rex.

| rex field=_raw "HAManager.thread.pool:(?<threadpoolvalue>[^,]+)"

4) If you are looking for ALL values, then rex JUST the relevant matchable items.

| rex field=_raw max-match=0 "\b(?<threadpoolname>[^:]+):(?<threadpoolvalue>\d+\/\d+\/\d+\/\d+)\b"

Those are aircode, so they may require some adjustment.

0 Karma

davidbarat
New Member

Thanks @DalJeanis I have modified my request by adding a fixed name and it's work fine.
I will modify my original post to display the code @richgalloway .
Thanks both of you.
David

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I've formatted the question to display the query as code. Please edit it to show the correct regular expression.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>