rex for source target

[indeed_2000]

Hi

here is my log:

2020-01-19 13:20:15,093 INFO ABC.InEE-Product-00000 [MyProcessor] Detail Packet: M[000] T[111] P[0A0000] AT[00] R[0000] TA[ABC.OutEE-Product] Status[OUT-LOGOUT,EXIT]

2020-01-19 13:36:08,185 INFO ABC.InEP-Product-00000 [MyProcessor] Detail Packet Lost: M[000] T[111] SA[ABC.InEE-Product]  R[0000]

what is the rex for

SOURCE=ABC.InEE-Product

TARGET=ABC.OutEE-Product

Model=000

Tip=111

POD=0A0000

any idea?

Thanks,

[venkatasri · Accepted solution]

Hi @indeed_2000 

You need two different rex as second event is little bit different from first you don't have every field there, see if you can merge them together.

| rex "\d+:\d+:\d+\,\d+\s+\w+\s+(?<SOURCE>\S+).+M\[(?<MODEL>[^\]]+)\]\s+T\[(?<TIP>[^\]]+)\]\s+P\[(?<POD>[^\]]+).+?TA\[(?<TARGET>[^\]]+)\]" 
| rex "\d+:\d+:\d+\,\d+\s+\w+\s+(?<SOURCE>\S+).+M\[(?<MODEL>[^\]]+)\]\s+T\[(?<TIP>[^\]]+)\]\s+SA\[(?<SOURCE>[^\]]+)"

 POD , TARGET missing in your second event.

---

An upvote would be appreciated and Accept solution if this reply helps! 

[codebuilder]

Have you tried using erex to build the regex for you? It's very handy.

https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchReference/Erex