Splunk Search

regex for event type.

brettcave
Builder

Hi, is it not possible to use a regex to determine an event type. I would like to usee something like:

\d{4}-\d{1,2}-\d{1,2}T\d{2}:\d{2}:\d{2}.\d{3}. \| [A-Z]+ \|

to classify events.

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can create an event type based on a search. In that search, use the regex command to match against your expression.

View solution in original post

brettcave
Builder

How do you use a regex command?

| regex _raw="(my regex)"

Message: Eventtype search string cannot be a search pipeline or contain a subsearch

Doesn't work.

0 Karma

brettcave
Builder

Both events are a sort of log4j / syslog custom brew, but with slightly different syntaxes, so the most effective way of categorizing them would be by rex.

martin_mueller's suggestion of creating a field extractor based on the rex is a great suggestion, and would work well for this situation.

0 Karma

brettcave
Builder

well I can't use any pipe command with event types, so it wouldn't work with | rex ... either. I have events that are generated from 2 sources, and want to use the format of the sources as event type identifiers, so for example, source 1 formats as follows:

2012-11-21T06:50:19.721Z | INFO | some message

and source 2 formats as follows:

Nov 20 23:26:43 localhost Nov 20 23:26:43 ip-10-0-3-148 INFO | com.my.logger | thread
0 Karma

Rob
Splunk Employee
Splunk Employee

It might be more informative if you can show us a more complete example. Such as the search with the entire regex.

The 'regex' command in splunk is used to filter events. If you want to extract fields, use the 'rex' command.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can create an event type based on a search. In that search, use the regex command to match against your expression.

brettcave
Builder

that is a great suggestion, and will work well. Thanks martin.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Bummer on the pipes. You can still use the regular expression, just go the long way by defining a field on that match, and create an eventtype based on that_field=*.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...