Adding this for reference @bsrikanthreddy5  `|eval nowstring=strftime(now(), "%Y-%m-%d")` ... View more

Lets say your url data is in field called URL then you can try below to get the required data in a field called myRequiredData : your query to return URL field | rex field=URL "(?<myRequiredData>(http(s)*:\/\/)[^\/\s]+)" | table URL, myRequiredData See the regex reference here ... View more

Not the same scenario but I got the similar error / issue so below is how i got it and then how I resolved it. I was using a timestamp table coulmn in a calculation and using that calculation to create new column for rising column as follows (b was timestamp table coulmn): select a,b,extract(hour from b) as c from myTable where c > ? order by c asc Issue here was I cannot use an alias c in where clause, so db connect was giving me the error mentioned in question. This is how I resolved it by writing expression twice: select a,b,c from ( select a,b, extract(hour from b) as c from myTable ) where c > ? order by c asc ... View more

How about trying this: your query to return events | rex "service url:\s*(?<service>.*)&maxd=60&mind=60" | table service see extraction here ... View more

Lets say you already have this combined information (xxxxxx\yyyyyy) in a field call data then you can try this: your query to return field data | rex field=data "(?<firstPart>[^\\]+)\\(?<secondPart>.*)" | table firstPart, secondPart where Field firstPart is everything before a \ Field secondPart is everything after a \ ... View more

This regex has the flaw that if there are more than two elements in the requirement stated in question and I quote I need to make it so that the regex looks for something that starts with "com.companyname.companyinitials." and ends with ".main" as the message this will fail for sure. It will fail for something like this with three elements between com.companyname.companyinitials and .main : com.companyname.companyinitials.servicename.servicenameApplication.abc.main ... View more

First part of my answer actually captures everything in newSession your query to return the events | rex field=_raw "Session=(?<newSession>[\S]+)" | table newSession ... View more

Awesome...happy to have helped. ... View more

we always learn something new with Splunk!! ... View more

@horsefez Please read the documentation here below: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments What you are asking me to do is "optional" and anyways field is always taken _raw as default. ... View more

How about trying this below to have all the relevant things [out of which you can choose what do you want to pick]: host=myhost source=/hosting/logs//.log CASE(Module) .ear OR *.war | rex "\[Module\s*(?<myWar>[\S]+) of application (?<myApp>[\S]+) (?<action>.+) from (?<prevState>[\S]+) to (?<curState>[\S]+) on server (?<server>[^\]]+)" | table myWar, myApp, action, prevState, curState, server See extraction here A better extraction which will ensure that spaces don't tumble the query can be seen here and using that your query shall look like as follows: host=myhost source=/hosting/logs//.log CASE(Module) .ear OR *.war | rex "\[Module\s*(?<myWar>[\S]+)\s*of\s*application\s*(?<myApp>[\S]+)\s*(?<action>.+)\s*from\s*(?<prevState>[\S]+)\s*to\s*(?<curState>[\S]+)\s*on\s*server\s*(?<server>[^\]]+)" | table myWar, myApp, action, prevState, curState, server ... View more

HI NIketnilay, I will try first one and let you know. However for the second comment-1,2,3 are not digits, nor static. They are an element of the uri which can be anything. Some sample of them are: qFfs3-sds30s-sadsd2-qwewe 12345678 xxxxuyt8908 The replacement however can be static which we can choose to group them as like xxxx-xxxx-xxx-xxx ... View more

can you please post sample log entries and what do u want to extract/replace from those log entries. ... View more

your query to return events | rex "data\"\:\"(?<temp>\d{4})(?<humid>\d{4})" | search temp>2500 and humid>5000 If you want the percentages to display then you can add following to above and table the evals. | eval temperature=round(temp/100,2) | eval humidity=round(humid/100, 2) | table temperature, humidity ... View more

May you try this below please: your query to return events | rex "\\\"middleName\\\":\\\"(?<mn>[^\\]+)\\\",\\\"lastName\\\":\\\"(?<ln>[^\\]+)\\\"" | table mn, ln See extractions here ... View more

Your spl line of rex is getting interpreted as below which is making it see it as a misplaced quote after two pairs of quotes: index=x ... | rex "^(?:[^" \n]* "){3}(?P<index_ks>[^" ]+)" Like @HiroshiSatoh mentioned the quotes shall be escaped like \" to make it as index=x ... | rex "^(?:[^\"\n]*\"){3}(?P<index_ks>[^\"]+)" if you feel your regex is working fine on regex101. ... View more

If the end goal is to count all the events then it shall be done on a field which occurs in all the events, something like field1 IP to get all the events. Ideal approach per my opinion shall be, filter events of "deny-service reports" and extract the field1 and field2. And filter events on "service-http reports" and extract all 5 fields. However if all need to be extracted in one extraction, below is what can be tried which shall assign "some value" when that field is absent from the event, and the required value when field is present in the event. your query to get events | rex "for host (?<ipAddress>(\d{1,3}\.)+\d{1,3}).+GET\s*(?<uri>[^,]+),\s*(deny-service reports:|service-http reports:)\s*(?<keycode>[^\s]+)(unable to contact|\s)*(?<backendHost>[^\s]+)\s*\(*(?<error>[^\)]+)*" | table ipAdderss, uri, keycode, backendHost, error Extraction is here ... View more

Can you please try this: your query to return the events | rex "\s*(?<serverName>[^\.]+)\.(?<remainingPart>[\S]+)" | table serverName If city.net always comes as a suffix, this might also work: your query to return the events | rex "\s*(?<serverName>[^\.]+)\.(.+\.)*city\.net" | table serverName ... View more

Since in you sample data, the mobile number comes always after keyword mobile however the " aren't always proper around it hence how about trying this: your query to return the field response | rex field=response max_match=0 "mobile(\D+)(?<mob>[\d]+)" | table mob, response This will create a multi-value field mob which will have all the mobile phone numbers which can be then used with mvexpand to tabulate or work upon something like below: your query to return the field response | rex field=response max_match=0 "mobile(\D+)(?<mob>[\d]+)" | mvexpand mob | table mob, response ... View more

let's say that the response time is being taken in a field called responseTime and the statement calculate every 10 seconds, the average response time for the past 5 minutes and plot on a graph means what is the average response time calculated for 10 sec spans and when watched over last 5 minutes, here is what you can try: your query to return field responseTime earliest=-5m | timechart span=10s avg(responseTime) ... View more