Splunk Search

issue in rex query

roopeshetty
Explorer

Hi Guys,
I have a log as below;

server1;443 status= running.
server2;443 status= running.
server3;443 status= running.
server4;443 status= running.

In this I need to create a field by name “ServerName” by targeting all server names as its values example server1, server2, server3 etc.

I am running the rex query as below;
|rex "(?.*);443"

now i am getting the expected result but an additional text lines will be added onto its values as below;

Message=server1
Message=server2
Message=server3
Message=server4

Any idea from where this word “Message=” is being added to these values as prefix and how can we remove it?

Tags (1)
0 Karma

vnravikumar
Champion

Hi @roopeshetty

Try with

^(?P<ServerName>.*);\d
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@roopeshetty ,

Looks like your group filed was removed from the question. Try to add code formatting whenever you add search strings.

Nevertheless, try this

rex "(?<server>.+);443"
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.