Splunk Search

mulitple regex extraction

dbcase
Motivator

Hi,

I'm trying to extract two fields from the below data

02-08 07:33:41.211 E/Rules_LightBaseAction( 2660): com.icontrol.device.DeviceException: Failed to turn light off.


02-08 07:30:19.611 E/Rules_LightBaseAction( 2660): Caused by: com.icontrol.zigbee.service.ZigbeeServiceException: executeCommand returned failure.

rulename=LightBaseAction and result=Failed to turn light off OR executeCommand returned failure

my attempt at the regex works for the rulename but not so much for the result.... What am I missing on the below regex?

E\/Rules_(?<rulename>\w+)(DeviceException|ZigbeeServiceException):\s+(?<result>$)
Tags (2)
0 Karma
1 Solution

vasanthmss
Motivator

try something like this,

base search | rex "E/Rules_(?<rulename>\w+).*(DeviceException|ZigbeeServiceException):\s+(?<result>.*)$"

Hope this will helps you.

V

View solution in original post

dbcase
Motivator

attempt #2 at regex but still no joy . E\/Rules_(?<rulename>\w+)Exception:\s(?<result>.+[^.])

0 Karma

vasanthmss
Motivator

try something like this,

base search | rex "E/Rules_(?<rulename>\w+).*(DeviceException|ZigbeeServiceException):\s+(?<result>.*)$"

Hope this will helps you.

V

dbcase
Motivator

Hi Vasanthmss!

Thank you! that helped! The final regex looks like this . E\/Rules_(?<rulename>\w+).*Exception:\s(?<result>.+[^.])

0 Karma

vasanthmss
Motivator

glad that helped.. accept the answer.

V
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...