Version 6.2 ... View more

I tried that but I encountered an error: Error in 'rex' command: Encountered the following error while compiling the regex 'Block number block_num (?P<.block_info.>\w{1,}?)': Regex: syntax error in subpattern name (missing terminator) This is my regex: ...| rex field=_raw "Block number block_num (?P<".block_info.">\w{1,}?)" ... View more

I think these are some of the options that I am looking for: (1) a way to use a extracted field inside a regex (2) If I extract all blocks in the event, is there is a way to look inside the field value to find if there is an error inside the block. Please consider that the field value is a string with several lines that include the word "ERROR". (3) Is there is a way to use regex for looking for a word and extract some lines that are before it and after including the word? ... View more

But you are only extracting the block_num which I already have. About the alternative about using a error-finding regex after I extracted all blocks. How can I use a regex to look inside field values? The following doesn't work because the block info is several lines, not only an error number: ...|search block_info="ERROR" ... View more

I extracted all blocks, but how I search for an error inside each block text. ... View more

ok. I'm going to give it a try. ... View more

It is a 3-5 digit number. ... View more

Yes, they are in the same event. The event is quite a long and mostly a text. The structure of the events are like: block number 500 ... info (sometimes there are errors here) .... info End of block number block number 501 ....info ...info End of block number 501 First I extract the error, then the block number where the error is, and finally I want to extract the whole block. Well... that's the idea. ... View more

I know the regex is wrong, I would like to know if there is a way to do it. ... View more

I already tried enclosing the block_num in [ ] or in $$. ... View more

Before the w there is a back slash. ... View more

Thanks for you answer! ... View more

I tried adding quotation marks before the dollar signs in the token or adding an extra dollar sign but nothing works. ... View more

No. That doesn't work. If I insert the token before save it no result will show in the dashboard. This my search query and it would not produce results either in search app or dashboard because there is no error_number = $ error_number$. index="job_event" error_number=$ error_number$ | stats values(test_number) as test_number by airplane_number The only way I could make this work is by doing an inline search in the dashboard. ... View more

Are you referring to report when you say saved search? If so I haven't found a way to use report while keeping my tokens for text input. ... View more

It worked perfectly. Thank you. ... View more

I am having the same problem. Do you solve it? I tried to change all quotation marks to " but that didn't change anything. ... View more

Well I changed the function to len() in order to see if I was having the same problem with other eval function and I found that non multi-value function work correctly in Splunk-web. eval expression = len(error_number) " " = ln(error_number) But these expression don't work: " " = mvdedup(error_number) " " = mvcount(error_number) ... View more

This is what I have In Splunk-web>Fields>Field transformations: Destination app = search Name = ERROR_EXTRACTION Regular expression = The Error Number is (?< error_number> [0-9-]{5,5}) source key = _raw Create multivalued fields = checked Splunk-web/Fields>Field extractions: Destination app = search Name = error_number sourcetype = Job_Log Type = Uses transformation Extraction/Transform = ERROR_EXTRACTION I tried these three eval expressions without success in Splunk>Fields>calculated fields: Destination app = search sourcetype = Job_Log Name = error_number 1. Eval expression = eval error_number=mvdedup(error_number) 2. Eval expression = error_number=mvdedup(error_number) 3. eval expression = mvdedup(error_number) ... View more

Well, I have a problem. I don't have admin privileges to modify those configuration files. Could you provided a solution using Splunk-webserver(not inline)? I already created the multivalue field using Splunk-webserver>Fields> Field Extractions and Field Transformations, but every time I tried to add any of your answers in Calculated Fields I encountered an error. Sorry, I know I should mentioned this from the beginning. ... View more