Splunk Enterprise Security

How to create regex with space delimiter field

gwes77
Explorer

Hello all, a regex is needed that's way above my head:
I have a message field in the notable index that holds multiple space delimiter hostnames on a host down alert. I need to separate out these values for a timechart. A sample of what is in the message field for each notable is listed below. I will need to exclude everything after hosts= and everything before \ncount=144 and each hostname has space in between. I want to call the new field criticalhosts.

hosts=XXXXC01 XXXXC05 XXXXM86 \ncount=144

Once that's done, I will need to do a stats count to show how many hosts went down per day over a month. I tried it with stats delim=" " but I am missing the first and last values in the field due to the extra verbiage. Thanks for the help.

0 Karma
1 Solution

woodcock
Esteemed Legend

From SPL do it like this:

.. | makeresults | eval _raw="host=a b c d e \ncount=144"
| kv

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "(?s)host=(?<host>[^\r\n=]+).*count=(?<count>\d+)"
| rex field=host mode=sed "s/\\\n.*$//"
| makemv host
| stats sum(count) AS downcount BY host

View solution in original post

woodcock
Esteemed Legend

From SPL do it like this:

.. | makeresults | eval _raw="host=a b c d e \ncount=144"
| kv

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "(?s)host=(?<host>[^\r\n=]+).*count=(?<count>\d+)"
| rex field=host mode=sed "s/\\\n.*$//"
| makemv host
| stats sum(count) AS downcount BY host

gwes77
Explorer

Would have never thought of that. Thanks for saving me time!

Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...