Adding this for reference @bsrikanthreddy5  `|eval nowstring=strftime(now(), "%Y-%m-%d")` ... View more

Lets say your url data is in field called URL then you can try below to get the required data in a field called myRequiredData : your query to return URL field | rex field=URL "(?<myRequiredData>(http(s)*:\/\/)[^\/\s]+)" | table URL, myRequiredData See the regex reference here ... View more

Not the same scenario but I got the similar error / issue so below is how i got it and then how I resolved it. I was using a timestamp table coulmn in a calculation and using that calculation to create new column for rising column as follows (b was timestamp table coulmn): select a,b,extract(hour from b) as c from myTable where c > ? order by c asc Issue here was I cannot use an alias c in where clause, so db connect was giving me the error mentioned in question. This is how I resolved it by writing expression twice: select a,b,c from ( select a,b, extract(hour from b) as c from myTable ) where c > ? order by c asc ... View more

How about trying this: your query to return events | rex "service url:\s*(?<service>.*)&maxd=60&mind=60" | table service see extraction here ... View more

Lets say you already have this combined information (xxxxxx\yyyyyy) in a field call data then you can try this: your query to return field data | rex field=data "(?<firstPart>[^\\]+)\\(?<secondPart>.*)" | table firstPart, secondPart where Field firstPart is everything before a \ Field secondPart is everything after a \ ... View more

This regex has the flaw that if there are more than two elements in the requirement stated in question and I quote I need to make it so that the regex looks for something that starts with "com.companyname.companyinitials." and ends with ".main" as the message this will fail for sure. It will fail for something like this with three elements between com.companyname.companyinitials and .main : com.companyname.companyinitials.servicename.servicenameApplication.abc.main ... View more

First part of my answer actually captures everything in newSession your query to return the events | rex field=_raw "Session=(?<newSession>[\S]+)" | table newSession ... View more

Awesome...happy to have helped. ... View more

we always learn something new with Splunk!! ... View more

@horsefez Please read the documentation here below: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments What you are asking me to do is "optional" and anyways field is always taken _raw as default. ... View more

How about trying this below to have all the relevant things [out of which you can choose what do you want to pick]: host=myhost source=/hosting/logs//.log CASE(Module) .ear OR *.war | rex "\[Module\s*(?<myWar>[\S]+) of application (?<myApp>[\S]+) (?<action>.+) from (?<prevState>[\S]+) to (?<curState>[\S]+) on server (?<server>[^\]]+)" | table myWar, myApp, action, prevState, curState, server See extraction here A better extraction which will ensure that spaces don't tumble the query can be seen here and using that your query shall look like as follows: host=myhost source=/hosting/logs//.log CASE(Module) .ear OR *.war | rex "\[Module\s*(?<myWar>[\S]+)\s*of\s*application\s*(?<myApp>[\S]+)\s*(?<action>.+)\s*from\s*(?<prevState>[\S]+)\s*to\s*(?<curState>[\S]+)\s*on\s*server\s*(?<server>[^\]]+)" | table myWar, myApp, action, prevState, curState, server ... View more

HI NIketnilay, I will try first one and let you know. However for the second comment-1,2,3 are not digits, nor static. They are an element of the uri which can be anything. Some sample of them are: qFfs3-sds30s-sadsd2-qwewe 12345678 xxxxuyt8908 The replacement however can be static which we can choose to group them as like xxxx-xxxx-xxx-xxx ... View more

can you please post sample log entries and what do u want to extract/replace from those log entries. ... View more

your query to return events | rex "data\"\:\"(?<temp>\d{4})(?<humid>\d{4})" | search temp>2500 and humid>5000 If you want the percentages to display then you can add following to above and table the evals. | eval temperature=round(temp/100,2) | eval humidity=round(humid/100, 2) | table temperature, humidity ... View more

May you try this below please: your query to return events | rex "\\\"middleName\\\":\\\"(?<mn>[^\\]+)\\\",\\\"lastName\\\":\\\"(?<ln>[^\\]+)\\\"" | table mn, ln See extractions here ... View more

Your spl line of rex is getting interpreted as below which is making it see it as a misplaced quote after two pairs of quotes: index=x ... | rex "^(?:[^" \n]* "){3}(?P<index_ks>[^" ]+)" Like @HiroshiSatoh mentioned the quotes shall be escaped like \" to make it as index=x ... | rex "^(?:[^\"\n]*\"){3}(?P<index_ks>[^\"]+)" if you feel your regex is working fine on regex101. ... View more