regex for event type.

[brettcave]

Hi, is it not possible to use a regex to determine an event type. I would like to usee something like:

\d{4}-\d{1,2}-\d{1,2}T\d{2}:\d{2}:\d{2}.\d{3}. \| [A-Z]+ \|

to classify events.

[brettcave]

How do you use a regex command?

| regex _raw="(my regex)"

Message: Eventtype search string cannot be a search pipeline or contain a subsearch

Doesn't work.

[brettcave]

Both events are a sort of log4j / syslog custom brew, but with slightly different syntaxes, so the most effective way of categorizing them would be by rex.

martin_mueller's suggestion of creating a field extractor based on the rex is a great suggestion, and would work well for this situation.

[brettcave]

well I can't use any pipe command with event types, so it wouldn't work with | rex ... either. I have events that are generated from 2 sources, and want to use the format of the sources as event type identifiers, so for example, source 1 formats as follows:

2012-11-21T06:50:19.721Z | INFO | some message

and source 2 formats as follows:

Nov 20 23:26:43 localhost Nov 20 23:26:43 ip-10-0-3-148 INFO | com.my.logger | thread

[Rob]

It might be more informative if you can show us a more complete example. Such as the search with the entire regex.

The 'regex' command in splunk is used to filter events. If you want to extract fields, use the 'rex' command.

[martin_mueller · Accepted solution]

You can create an event type based on a search. In that search, use the regex command to match against your expression.

[brettcave]

that is a great suggestion, and will work well. Thanks martin.

[martin_mueller]

Bummer on the pipes. You can still use the regular expression, just go the long way by defining a field on that match, and create an eventtype based on that_field=*.