use rex to define a string as a field

[c799651]

Hi,

I have an index that returns alarms with details as  string. I want to define the text in bold  as a field. The string can vary according the the alarm event. 

07/10/2020 23:59:06 [37104$0]: sndala.cxx.68: disk space is less than threshold ,TYPE=SINGLE, LEVEL=major...

thanks

[inventsekar]

(edited)tested and its working fine:

| makeresults 
| eval log="07/10/2020 23:59:06 [37104$0]: sndala.cxx.1185: disk space is less than threshold ,TYPE=SINGLE, LEVEL=major" 
|rex field=log "cxx\.1185\:(?<errortype>.*)\ \," | table errortype

(PS - i have given around 500+ karma points so far, received badge for that, if an answer helped you, a karma point would be nice!. we all should start "Learn, Give Back, Have Fun") 

[inventsekar]

Hi @c799651 your question was bit confusing.. so i assumed that you want to use rex to extract...

| makeresults 
| eval log="07/10/2020 23:59:06 [37104$0]: sndala.cxx.68: disk space is less than threshold ,TYPE=SINGLE, LEVEL=major" 
|rex field=log "\:\ (?<LogEvent>.*)\,TYPE" | table LogEvent

 

(PS - i have given around 500+ karma points so far, received badge for that, if an answer helped you, a karma point would be nice!. we all should start "Learn, Give Back, Have Fun")

[c799651]

Thanks and sorry I was not clear.

I basically want to use rex to define a string as field called errortype

as an example the event may contain the following

cxx.1185:  An IP address becomes unavailable , 

or another error may be

cxx.1185:  Map is full ,

this is what I tried 

the error description is always after the cxx.1185 and before the next comma,

This almost worked, but I can't work out how to pattern match everything after cxx.1185:  and before the next  comma. I tried things like " *," but that didn't work

index=alarm-app-n 
| rex field=_raw "cxx.1185:(?<errortype>*,)"

I worked it out  after I bit more searching on splunk answers. This works

index=alarm-app-n LEVEL=major
| rex field=_raw "cxx.1185:(?<errortype>[^,]+)"