parsing _internal logs

[JohnEGones]

Hi Fellow Splunkers,

Have a hopefully quick question:

Want to pull out the source and host from the Windows _internal splunk logs, but my rex (cribbed from a post on here) isn't working.

index=_internal host IN (spfrd1, spfrd2) source="*\\Splunk\\var\\log\\splunk\\splunkd.log" component=DateParserVerbose 
| rex "Context: source=(?P<sourcetypeissue>\w+)\Shost=(?P<sourcehost>\w+)" 
| stats list(sourcetypeissue) as file_name list(sourcehost)

But I get no stats, my events look like this:

08-24-2022 07:50:20.383 -0400 WARN  DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Sun Aug 24 07:49:58 2022). Context: source::WMI:WinEventLog:Security|host::SPFRD1|WMI:WinEventLog:Security|1

[JohnEGones]

ITWhisperer,

Yeah that doesn't work but now I realize its because there is a file path reference:

source::X:\logs\[some IP]\log123.txt|host::[host]

[ITWhisperer · Accepted solution]

Try it like this

| rex "Context: source::(?P<sourcetypeissue>\w+)\Shost::(?P<sourcehost>\w+)"