Splunk Search

regex extraction

mehrdad_2000
Communicator

Hi 

from this log:

23:52:52.758 alex appinfo: Terminating due to signal: 1

 

How can I extract these item with rex:

user=alex

appname=appinfo

signal=1

 

Thanks,

Labels (4)
Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mehrdad_2000 

Can you please try this?

YOUR_SEARCH| rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<user>\w+)\s(?<appname>\w+).*signal\:\s(?<signal>.*)"

 

My Sample Search :

| makeresults |eval _raw="23:52:52.758 alex appinfo: Terminating due to signal: 1" | rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<user>\w+)\s(?<appname>\w+).*signal\:\s(?<signal>.*)"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
 

View solution in original post

ITWhisperer
Legend

| rex "\S+\s(?<user>\S+)\s(?<appname>\S+):\s.*?signal:\s(?<signal>\d+)"

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mehrdad_2000 

Can you please try this?

YOUR_SEARCH| rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<user>\w+)\s(?<appname>\w+).*signal\:\s(?<signal>.*)"

 

My Sample Search :

| makeresults |eval _raw="23:52:52.758 alex appinfo: Terminating due to signal: 1" | rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<user>\w+)\s(?<appname>\w+).*signal\:\s(?<signal>.*)"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
 

View solution in original post

mehrdad_2000
Communicator

it work separately but not work all in same time

Worked

rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<user>\w+)
rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<appname>\w+)
rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3} .*signal\:\s(?<signal>.*)"

 

Not worked

| rex field=_raw "[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,3}.[0-9]{1,3}\s(?<user>\w+)\s(?<appname>\w+).*signal\:\s(?<signal>.*)"

 

any idea?

Thanks

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mehrdad_2000 

It's working for me on your given sample data. Can you please share those sample events which are not extracting?

 

Screenshot 2021-06-29 at 2.57.16 PM.png