Splunk Search

mulitple regex extraction

dbcase
Motivator

Hi,

I'm trying to extract two fields from the below data

02-08 07:33:41.211 E/Rules_LightBaseAction( 2660): com.icontrol.device.DeviceException: Failed to turn light off.


02-08 07:30:19.611 E/Rules_LightBaseAction( 2660): Caused by: com.icontrol.zigbee.service.ZigbeeServiceException: executeCommand returned failure.

rulename=LightBaseAction and result=Failed to turn light off OR executeCommand returned failure

my attempt at the regex works for the rulename but not so much for the result.... What am I missing on the below regex?

E\/Rules_(?<rulename>\w+)(DeviceException|ZigbeeServiceException):\s+(?<result>$)
Tags (2)
0 Karma
1 Solution

vasanthmss
Motivator

try something like this,

base search | rex "E/Rules_(?<rulename>\w+).*(DeviceException|ZigbeeServiceException):\s+(?<result>.*)$"

Hope this will helps you.

V

View solution in original post

dbcase
Motivator

attempt #2 at regex but still no joy . E\/Rules_(?<rulename>\w+)Exception:\s(?<result>.+[^.])

0 Karma

vasanthmss
Motivator

try something like this,

base search | rex "E/Rules_(?<rulename>\w+).*(DeviceException|ZigbeeServiceException):\s+(?<result>.*)$"

Hope this will helps you.

V

dbcase
Motivator

Hi Vasanthmss!

Thank you! that helped! The final regex looks like this . E\/Rules_(?<rulename>\w+).*Exception:\s(?<result>.+[^.])

0 Karma

vasanthmss
Motivator

glad that helped.. accept the answer.

V
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...