Hello, I am trying to put together a regex to extract a string. The issue I have is that the string sometimes contains dashes as a seperator as in 11-23345-6778-CMP and sometimes there is simply a space 11 23345 8897 CMP . I have a regular expression that extracts the string with the dashes, but I am struggling to work out how to also ask the same expression to extract strings that have a space instead. Is it even possible to combine the two ? The expression I have is: rex "(?i)\\|.*?\\|(?P<POLICYNUMBERS>\\d+\\-[a-f0-9]+\\-\\w+)" Any help or advice is as always greatly appreciated. Cheers, Alastair ... View more

Hello, I am attempting (unsuccessfully so far) to display multiple date_wday values in a single table column. My search checks for errors over a 7 day period. There are errors that occur on multiple days or may only occur after a certain day (in the case of application updates etc). My end aim is to produce table that has the error and the days that the error occurred on. <Search> | table error dayserroroccurredon ++Output++ ERROR XXXXX Mon, Tues, Wed ERROR XXXXX Wed, Thursday I have tried various appends but none give me the result I want and simply put each day on a new line Is there away to combine the day values into a single field that can then be outputted to a table ? Any help or advise will be greatly appreciated. Cheers, Alastair ... View more

Hello to all.. I am attempting (partially succesfully so far) to extract some text. The problem I am having is that it is also extracting unwanted text past the vaue I am (obviously incorrectly) specifying as the end point. The string I am trying to extract is (in this example) ALEXANDRIA ALEXANDRIA (attempting to extract the text between > and <) The expression I am using is rex field=_raw "\(?\S+)\<" However, when I run the search, I also get the proceeding text in the returned value below: ALEXANDRIANSW2015AUAustralia As I say it is sort of working but I am unsure as to how to instruct the expression to stop at the < after the suburb name. Any help or pointers will be gratefully accepted. ---update-- The input string is <mm:SuburbName>ALEXANDRIA</mm:SuburbName> The suburb will vary The output I am getting is ALEXANDRIA</mm:SuburbName><mm:StateOrProvinceCode>NSW</mm:StateOrProvinceCode><mm:PostalCode>2015</mm:PostalCode><mm:CountryCode>AU</mm:CountryCode><mm:CountryName>Australia</mm:CountryName> Cheers all. Alastair ... View more

Hello, With my virtually non existent skills around regex I am struggling to get an extraction to work 😞 I am trying to extract some text after the third / as per the below [http://10.91.11.47:1200/WMB_SAFIRE_INT/BCSWebservice/services/ProcessQuoteMB] The text I want to extract is everything after the 3rd / so WMB_SAFIRE_INT/BCSWebservice/services/ProcessQuoteMB (the text content & length can vary but the start and end point of the text is consistent in that it starts with [http:// and ends with ]). The result is then piped to a field(?) called WS (?) Any help or pointers would be very much appreciated Cheers, Alastair ... View more

I have a rather frustrating issue in that , try as I might, I cannot get a simple table to work as a drilldown. I have tried both 'SimpleResultsTable' and 'Table' but to no avail. The xml is below and for the life of me I cannot work out what I am missing...( most likely something very simple but as yet it eludes me) <param name="maxSize">1</param> <param name="clearOnJobDispatch">True</param> <param name="filter">*</param> <param name="maxSize">1</param> <param name="clearOnJobDispatch">True</param> <param name="filter">splunk.search.job</param> <param name="search">index=systemout host="aalwsppdc001*" earliest=-24h@h latest=now ERROR | rex field=_raw " ERROR (?&lt;errortype&gt;[\w\.[.]+)" | top limit=50 errortype </param> <param name="groupLabel">Errors</param> <module name="EnablePreview"> <param name="display">False</param> <param name="enable">True</param> </module> <module name="SimpleResultsTable"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> Thank you in advance for any assistance. Cheers, Alastair ... View more

Hello. I am trying to set a default value for a drop down list populated from a search but no matter what I try the default keeps on setting itself to 'All' despite there being no 'All' in the list of available options (the list is derived from a lookup table). | inputlookup Safire_Broker.csv | dedup ACTION ACTION Quote Type.... $name$ I have checked some of the previous that had similar queries but none of the answers tried have worked. Any help is greatly appreciated. Cheers, Alastair ... View more