field extraction

[ranjithan]

name uuid sysfs size dm-st paths failures action path_faults vend prod rev

mpatha 360002ac000000000000010e30001c751 dm-1 120G active 4 0 0 3PARdata VV 3315

mpathb 360002ac000000000000010fb0001c751 dm-0 240G active 4 0 0 3PARdata VV 3315

The above is my multiline event in table format...

I need to extract the below values(mpath, uuid):

mpatha 360002ac000000000000010e30001c751

mpathb 360002ac000000000000010fb0001c751

Please help me. im new to this.. thank you so much..

[gcusello · Accepted solution]

Hi @ranjithan,

please try this regex

| rex "^(?<name>\w+)\s+(?<uuid>[^ ]+)"

that you can test at https://regex101.com/r/HsvUJg/1

Ciao.

Giuseppe

[ranjithan]

thank you so much! 

[gcusello]

Hi @ranjithan,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉