Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
8,000 results
Sorted by:
Monday
I have event like this from here i have to extract bold name like : Burp-collab Qualys_scanner_RPA SIE-PT-BAU-1 SIE-PT-BAU-2Kali can any one help me on this ...
Labels
- Labels:
-
other
Show results in replies (4)
-
values will be extracted new field called "newfield" | rex "(?<newfield>[^\/]+)(?=.vmx)"
-
| index=yourindex | rex "(?<newfield>[^\/]+)(?=.vmx)" | table newfield
-
| rex "(?<VMX>[^\/]+)\.vmx" This one works...thanx for ur help
-
Following the previous answer, simply use a stats command: | index=yourindex | rex "(?<n...
a week ago
i have one host with multiple sourcetype , i want to extract some field but that field also have some different so for all events i have to write different different rex command , is there a...
Labels
- Labels:
-
rex
07-07-2020
04:36 AM
...ervices im using rex "(^(?<Service>\s\s\w+.\w+))\s\s" but having no luck. Also want to extract "Running" as status
- Tags:
- fields
Labels
- Labels:
-
field extraction
-
fields
-
rex
07-18-2020
12:57 AM
I'm trying to extract this line from my linux logs in splunk using rex but I'm not sure how to extract it TCP 191.174.4.187:80 -> 10.10.50.26:100
Labels
- Labels:
-
field extraction
-
rex
12-18-2019
05:41 AM
...egment".
Here is my rex command :
(Converted segments:(\s\w{3}+\s-)+\s|)(?<grammar_error_reason>.+) (from here|segment\.)
Can you help me please.
Kind regards,
Clement
Show results in replies (5)
-
...RAMMAR_ERROR | rex "Converted segments:(\s\w{3}+\s-)+\s+(?<grammar_error_reason1>[\w\s]+) f...
-
Try adding the max_match=0 option to the rex command. Two separate rex commands should w...
-
This regex may work for you. If it doesn't, consider using two rex commands - one for each e...
-
...ptimize-rex-command.html
-
Hi @richgalloway, Unfortunatly your rex command do not work cause it exceeded configured m...
02-20-2019
01:04 AM
I am trying to extract about 4 fields from a log line. Each lines have about 1500 character.
I can only extract 2 fields and i get an error saying my rex has exceeded configured match_limit, c...
08-05-2016
10:20 AM
Hi,
I have this search in attempting to extract the IP address, but no luck.
blah....|rex "beta.icontrol.com\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"
The s...
07-21-2020
08:45 AM
...eturns results, "process start" OR "process end". Then i use Rex to grab the transaction id which also returns results, | rex field=_raw "Correlation Id: \[(?<correlation_id>.*)\] " Next s...
- Tags:
- transaction rex
Labels
- Labels:
-
rex
-
transaction
05-20-2020
07:39 PM
...essage "Message="Internal event: Function ldap_search entered."
by rex to define as fields or use eval command?
- Tags:
- splunk-enterprise
Labels
- Labels:
-
rex
11-05-2018
01:14 PM
...uge rex's (due to the positions i guess). One good thing is the name of the instance, the comma, and the numbers are always in the same alignment.
Can anyone help ? Thanks community!
George
