Getting Data In

Regex help

SS1
Path Finder

Hi,

I have the below event where i tried to extract field ServerA

Event:

ADMU0509I: The Application Server "serverA" cannot be reached. It appears to be stopped.

Query: source="teststatus"| rex max_match=100 field=_raw "Server\s"(?P<jvm>.*)"\s*cannot\sbe\s(?P<status>.*)"|table jvm,host

Output is showing as "serverA" instead of serverA. I dont want the double quotes, how do i achieve that?

 

0 Karma
1 Solution

493669
Super Champion

@SS1 
You can use backslash before quotes to consider in regex like below-

source="teststatus"| rex max_match=100 field=_raw "Server\s\"(?P<jvm>.*)\"\s*cannot\sbe\s(?P<status>.*)"|table jvm,host

 

 

 

 

If this helps an upvaote will be appreciated!

View solution in original post

SS1
Path Finder

Thanks. This solution worked

0 Karma

493669
Super Champion

@SS1 
You can use backslash before quotes to consider in regex like below-

source="teststatus"| rex max_match=100 field=_raw "Server\s\"(?P<jvm>.*)\"\s*cannot\sbe\s(?P<status>.*)"|table jvm,host

 

 

 

 

If this helps an upvaote will be appreciated!

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!