Splunk Search

regex help

surekhasplunk
Communicator

{"device":"abcd","host":"1.2.3.4"}
{"device":"efgh [ = ILO = ]","host":"2.3.4.5"}
{"device":"qrst - [ab cd ef]","host":"4.5.6.7"}

My data looks like this in the _raw.

now i am trying to fetch device and host using regex. please help. It should be simple but since host is a default keyword the host from which data is coming is also coming with field name host so i need to rename host coming in _raw to ip

Tags (3)
0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
|makeresults
| eval _raw="{\"device\":\"abcd\",\"host\":\"1.2.3.4\"}
{\"device\":\"efgh [ = ILO = ]\",\"host\":\"2.3.4.5\"}
{\"device\":\"qrst - [ab cd ef]\",\"host\":\"4.5.6.7\"}"
| multikv noheader=t
| fields _raw
| spath

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust
|makeresults
| eval _raw="{\"device\":\"abcd\",\"host\":\"1.2.3.4\"}
{\"device\":\"efgh [ = ILO = ]\",\"host\":\"2.3.4.5\"}
{\"device\":\"qrst - [ab cd ef]\",\"host\":\"4.5.6.7\"}"
| multikv noheader=t
| fields _raw
| spath

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try this rex

|rex "\"device\"\:\"(?P<device>[^"]+)\"\,\"host\"\:\"(?P<ip>[^"]+)"
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.