need help in displaying specific fields from below output

[rkdasari]

Hi

Need help in displaying Client and /use71-mobstor-bf1/vol070 with dedup, as logs has similar entries.

Nov 2 19:13:54 netapp-master9.bkp.bf1.yahoo.com NetVault[2655]: NetVault: Client: 'netapp_master9_bkp_bf1' Class: 'Data Plugin' Job: '21483' Warnlevel: 'Error' Msg: 'NDMP: ERROR 1: DATA: Operation terminated: Backup of non-local Volume '/use71-mobstor-bf1/vol070' not supported (for /use71-mobstor-bf1/vol070)'

Nov 2 18:44:02 netapp-master9.bkp.bf1.yahoo.com NetVault[2655]: NetVault: Client: 'netapp_master9_bkp_bf1' Class: 'Data Plugin' Job: '21483' Warnlevel: 'Error' Msg: 'NDMP: ERROR 1: DATA: Operation terminated: Backup of non-local Volume '/use71-mobstor-bf1/vol070' not supported (for /use71-mobstor-bf1/vol070)'

ov 2 01:14:15 netapp-master9.bkp.bf1.yahoo.com NetVault[2655]: NetVault: Client: 'netapp_master9_bkp_bf1' Class: 'Data Plugin' Job: '22191' Warnlevel: 'Error' Msg: 'NDMP: ERROR 1: DATA: Operation terminated: Backup of non-local Volume '/use71-mobstor-bf1/vol178' not supported (for /use71-mobstor-bf1/vol178)

Expecting output like below:

netapp_master9_bkp_bf1 /user71-mobstor-bf1/vol178 vol178 (as i need to run a query for vol178 value)

Thanks,
Ram

[sundareshr · Accepted solution]

Try this command to extract the fields and display

| rex "Client:\s'(?[^']+).*Volume\s'(?[^']+)" | dedup volume | table client volume

[rkdasari]

thanks for sharing the command but, it is giving below error.

"Error in 'rex' command: Encountered the following error while compiling the regex 'Client:s'(?[^']+).*Volume'(?[^']+)': Regex: unrecognized character after (? or (?- "

[sundareshr]

I just tested this and get the desired results. Test this and let me know if you get the same error. This time I entered it as a code sample... Learn something new everyday 🙂

index=* | head 1 | eval s="Nov 2 18:44:02 netapp-master9.bkp.bf1.yahoo.com NetVault[2655]: NetVault: Client: 'netapp_master9_bkp_bf1' Class: 'Data Plugin' Job: '21483' Warnlevel: 'Error' Msg: 'NDMP: ERROR 1: DATA: Operation terminated: Backup of non-local Volume '/use71-mobstor-bf1/vol070' not supported (for /use71-mobstor-bf1/vol070)'" | rex field=s "Client:\s'(?<client>[^']+).*Volume\s+'(?<volume>[^']+)" | dedup volume | table s client volume

[rkdasari]

yes it is displaying client and volume in a table format when i run above command that is awesome, but when i try to run this command non-local Volume host="netapp-master9.bkp.bf1.yahoo.com" | rex field=s "Client:\s'(?[^']+).*Volume\s+'(?[^']+)" | dedup volume | table client volume

it is giving error "No Results Found", i am also trying to do modifications on syntax. Yes learning something new is always excited 🙂

Thanks,
Ram

[rkdasari]

Hurray i got it, thank you very much for your guidance finally i got the output what i am looking for.

non-local Volume host="netapp-master9.bkp.bf1.yahoo.com" | rex "Client:\s'(?[^']+).*Volume\s+'(?[^']+)" | dedup volume | table client volume

[rphillips_splk]

Hi Ram are Client and Volume already extracted fields or do you also need help with the regex to extract these fields?

[rkdasari]

No they are not extracted fields, i need to fetch those using regex. I have tried below command but its giving error.
"Error in 'rex' command: Encountered the following error while compiling the regex 'Client:s'(?[^']+).*Volume'(?[^']+)': Regex: unrecognized character after (? or (?- "

| rex "Client:s'(?[^']+).*Volumes'(?[^']+)" | dedup volume | table client volume