Splunk Search

field extraction

ranjithan
Path Finder

name uuid sysfs size dm-st paths failures action path_faults vend prod rev

mpatha 360002ac000000000000010e30001c751 dm-1 120G active 4 0 0 3PARdata VV 3315

mpathb 360002ac000000000000010fb0001c751 dm-0 240G active 4 0 0 3PARdata VV 3315

 

The above is my multiline event in table format...

I need to extract the below values(mpath, uuid):

mpatha 360002ac000000000000010e30001c751

mpathb 360002ac000000000000010fb0001c751

Please help me. im new to this.. thank you so much..

Labels (1)
0 Karma
1 Solution

gcusello
Legend

Hi @ranjithan,

please try this regex

| rex "^(?<name>\w+)\s+(?<uuid>[^ ]+)"

that you can test at https://regex101.com/r/HsvUJg/1

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @ranjithan,

please try this regex

| rex "^(?<name>\w+)\s+(?<uuid>[^ ]+)"

that you can test at https://regex101.com/r/HsvUJg/1

Ciao.

Giuseppe

ranjithan
Path Finder

thank you so much! 

0 Karma

gcusello
Legend

Hi @ranjithan,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...