Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
8,000 results
Sorted by:
10-14-2020
02:45 PM
Hello, I'm not so good with REX formula, if someone can help me and give me some tip for next time, I appreciate, thanks. I need to extract the balance (50446.50), the info is in field1 ' C...
Labels
- Labels:
-
Splunk Web Framework
03-19-2021
06:29 AM
hello My field sounds like this 03/01/2019 07:10 0 MBAM CLIENT (2.5_64b) EN.$w$ And I need to catch everything after 03/01/2019 07:10 0 it means I ...
- Tags:
- other
Labels
- Labels:
-
other
Show results in replies (9)
-
You don't need field1=, rex defaults to matching against _raw.
-
| rex "\d+\/\d+\/\d+\s+\d+:\d+\s+\d+\s+(?<field>.*)"
-
Hi @jip31, yes: the rex command has a different syntax: | rex "\d+\/\d+\/\d+\s+\d+:\d+\s\d...
-
...lags" | rex field1="\d+\/\d+\/\d+\s+\d+:\d+\s\d+\s+(?<field1>.*)" | table field1 is there s...
-
Hi @jip31 , Try this. | rex field=_raw " \d+\/\d+\/\d+\s\d+:\d+\s\d\s...
-
Hi @jip31, to catch all after the string "03/01/2019 07:10 0 ", please, try this regex: | rex...
-
Have you tried this - it is subtly different from the other rex strings because it takes into a...
-
...inted not the one you used) replacing your_field with software? | rex "\d+\/\d+\/\d+\s+\d+:\d+\s\d+\s...
-
Hi @jip31, Your linebreaker problem seems because of timestamps. It assumes %m-%d-%Y but it %...
01-18-2021
01:09 AM
...epartment C I want to use rex to dissect them to their own fields like TIME, FROM, TO, etc... But the thing is every fields in the log are dynamic, meaning they don't always stay the same. I pretty new to r...
Labels
- Labels:
-
field extraction
-
regex
-
rex
12-30-2020
04:33 AM
wed } } }, { "S" : "12:00" } } }, "day" M" : { "close" : { "S" : "23:00" open "S" : "12:00" } } } } }, "email" : { "S" : " DHours" } } }, "email" : { "S" : " Hours" } } }] | rex "wed.\D}.\D.\D.(?&l...
Labels
- Labels:
-
rex
09-14-2020
11:24 PM
I have event like this from here i have to extract bold name like : Burp-collab Qualys_scanner_RPA SIE-PT-BAU-1 SIE-PT-BAU-2Kali can any one help me on this ...
Labels
- Labels:
-
other
Show results in replies (4)
-
values will be extracted new field called "newfield" | rex "(?<newfield>[^\/]+)(?=.vmx)"
-
| index=yourindex | rex "(?<newfield>[^\/]+)(?=.vmx)" | table newfield
-
| rex "(?<VMX>[^\/]+)\.vmx" This one works...thanx for ur help
-
Following the previous answer, simply use a stats command: | index=yourindex | rex "(?<n...
12-14-2020
08:15 AM
Hey, is there anyone there good with rex expressions? I've been given a task by my boss, to extract 4 new fields from the data in one fiend, pluginText. The data that's currently in pluginText i...
- Tags:
- rex
Labels
- Labels:
-
rex
Show results in replies (3)
-
...o a little modify your regexes: | rex "Model\s+:\s+(?<Model>[^ ]+)" | rex "Software\s+v...
-
...ollowing four regexes: | rex field=plugin_output "Model\s+:\s+(?<Model>[^ ]+)" | rex field=p...
-
...oftware_name and software_version. | rex max_match=100 field=pluginText "\n+(?<software_name>[^[].*)\s\s...
4 weeks ago
...* I can grab the 2 IPs and ports with spaces between them. I am confused about how to assign each to a new field. Can someone help? Or do I have to use REX for search time extraction? E...
Labels
- Labels:
-
field extraction
-
rex
09-11-2020
06:35 AM
i have one host with multiple sourcetype , i want to extract some field but that field also have some different so for all events i have to write different different rex command , is there a...
Labels
- Labels:
-
rex
09-28-2020
09:53 AM
Hi, I am new to splunk, I am trying to extract specific message from my log event. The pattern I am looking from below message [ERROR] 2020-09-28T11:50:06.108Z &n...
Labels
- Labels:
-
field extraction
-
fields
-
regex
-
rex
-
subsearch
