Hi Fellow Splunkers,
Have a hopefully quick question:
Want to pull out the source and host from the Windows _internal splunk logs, but my rex (cribbed from a post on here) isn't working.
index=_internal host IN (spfrd1, spfrd2) source="*\\Splunk\\var\\log\\splunk\\splunkd.log" component=DateParserVerbose
| rex "Context: source=(?P<sourcetypeissue>\w+)\Shost=(?P<sourcehost>\w+)"
| stats list(sourcetypeissue) as file_name list(sourcehost)
But I get no stats, my events look like this:
08-24-2022 07:50:20.383 -0400 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Sun Aug 24 07:49:58 2022). Context: source::WMI:WinEventLog:Security|host::SPFRD1|WMI:WinEventLog:Security|1
Try it like this
| rex "Context: source::(?P<sourcetypeissue>\w+)\Shost::(?P<sourcehost>\w+)"
ITWhisperer,
Yeah that doesn't work but now I realize its because there is a file path reference:
source::X:\logs\[some IP]\log123.txt|host::[host]
Try it like this
| rex "Context: source::(?P<sourcetypeissue>\w+)\Shost::(?P<sourcehost>\w+)"