Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

What is the regular expression for my sample events?

rajgowd1
Communicator
‎11-16-2016 03:38 PM

HI,
i am trying to extract the last field using field extractor but its not working. can anyone help me to write regex for below sample events?

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,   HAOnly = 1;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,   haLogStatus = enabled;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,   logLen = 10485760;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,   haLogPath = /logs/luna;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,HAConfiguration = {
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,   CBOL-HA = 1;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,HASynchronize = {
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,   VirtualToken00Members = 157803010,155322014;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,   VirtualToken00SN = 1157803010;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,   VirtualToken00Label = CBOL-HA;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,VirtualToken = {
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp

Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,   ServerHtl01 = 0;
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

gokadroid
Motivator
‎11-16-2016 05:45 PM

Try this which will extract values in fields called dateTime, myField1,myField2:

your query to return the events
| rex field=_raw "^(?<dateTime>[^,]+),(?<myField1>[^,]+),(?<myField2>.*)"
| table dateTime, myField1, myField2

View solution in original post

0 Karma
Reply
Solved! Jump to solution
Solution

gokadroid
Motivator
‎11-16-2016 05:45 PM

Try this which will extract values in fields called dateTime, myField1,myField2:

your query to return the events
| rex field=_raw "^(?<dateTime>[^,]+),(?<myField1>[^,]+),(?<myField2>.*)"
| table dateTime, myField1, myField2
0 Karma
Reply
Solved! Jump to solution

rajgowd1
Communicator
‎11-16-2016 08:27 PM

Thank you,i am able do field extraction using delimiter and i will try this also

Reply
Register for .conf25!
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...