Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
10,000 results
Sorted by:
11-29-2021
02:16 AM
REX command to create a field domain from website EX: input : https://www.youtube.com/sd/td/gs-intro output: www.youtube.com
Labels
- Labels:
-
introduction
05-27-2021
09:33 AM
field1=abcdCheck:123456wxyz, sdfCheck:234567qwe I want get the result as Check:123456
Labels
- Labels:
-
field extraction
10-14-2020
02:45 PM
Hello, I'm not so good with REX formula, if someone can help me and give me some tip for next time, I appreciate, thanks. I need to extract the balance (50446.50), the info is in field1 ' C...
Labels
- Labels:
-
Splunk Web Framework
12-14-2021
04:46 AM
need help on removing only endpoint from the data set input : &nb...
Labels
- Labels:
-
rex
11-15-2021
06:01 AM
I want to extract the Country and the Node. When I use the rex in regex101, it works fine. But when I put it on Splunk search, it did not extract the Country and the Node. Do you guys know where is m...
Labels
- Labels:
-
troubleshooting
10-24-2021
06:54 PM
...QL_TEXT, "User" = DB_USER , "Source" = sourcetype
| rex field=_raw "SQL_TEXT=\S(?P<Type>\W?......)\s"
| rex field=_raw "DB_USER=(?P<UserName>..........)"
| table "Date and Time", "D...
Show results in replies (8)
-
I'm assuming each line is a separate event: | rex field=_raw "(?<date>\w{3} \d+ \d+:\d+:\d...
-
...odification on *" NOT select | rex field=_raw "SQL_TEXT=\S(?P<Type>\W?......)\s" | rex field=_...
-
...hich I hope you would help me get solved. I have 2 separate queries that I built using Rex. 1. T...
-
...ame pattern, the line below should capture what you want: | rex field=_raw ":\d+ (?<hostname>....
-
@IZ88 Woww....That worked wonders. I really appreciate the explanation.
-
Hi @GRC, There are 2 way you can approach this task: 1. Build your REX filter so i...
-
Hi @IZ88, Could you please help me ? I really appreciate. I run the below 1,2,3 querie...
-
Hi @IZ88 Thank you for the append query. I am trying to build the rex command....
12-02-2021
06:53 AM
Need help on trimming the month from the field EX: Input November 29, 2021 2:02:33 PM output Nov 29, 2021 2:02...
Labels
- Labels:
-
troubleshooting
11-28-2021
12:46 AM
...ant to extract the uid data as well as the Message which is inside the a_msg. I have rex field=log "uid=\"(?<uid>\d{1,}+)" which gives me the uid, but I am REALLY struggling with t...
03-11-2022
09:46 AM
i need the fields extracted by two fields
1) Detail message = before the comma ( I need the full description)
2) Count = after the comma ( I need the...
- Tags:
- rex
- splunk-search
Labels
- Labels:
-
field extraction
-
rex
Show results in replies (5)
-
...bsp; That means the regular expression matches multiple strings, but the rex command defaults to r...
-
This should get you started | rex "(?<detailMessage>[^,]+), (?<count>\d+)"
-
Thanks, @ richgalloway. But here I am only getting the first line for the fields extracted in...
-
You say you only get one line, but the screenshot shows 7 lines. Please provide more information, ...
-
...creenshot shows the rex is working only for the first line.
06-07-2021
01:26 PM
How do i extract this message in splunk rex field to display error code and message in reports like ABC_Code and Message? " exception " : " java.util.concurrent.ExecutionException : A...
Labels
- Labels:
-
using Splunk Enterprise
Show results in replies (9)
-
Try below regular expression |rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE&g...rex.JPG (126 KB)
-
Yeah it is just a rex command so it will show raw events. If you want a table like you asked in&n...
-
| rex "(?<errorCode>ABC(_|\-)\d+):(?<errorMessage>.*)"
-
didnt work with this rex query
-
| rex field=fieldX "(?<ABCcode>ABC(_|-)\d+):(?<message>.*?)"
-
Perhaps this will work? | rex field=fieldX "(?<ABCcode>ABC(_|\-)\d+):(?<message>.*?)"
-
...n below. so there will be two. index=abc "exception":"CommonApplicationException" | rex f...
-
...xecutionException") | rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)" | rex f...
-
...re unable to process your request. index=abc ABC-* |rex field=_raw "e...
