Splunk Search

Simple regex problem

neilstuartcraig
New Member

Hi all

I have hit a problem with Splunk which I am hoping someone might be able to offer some help with. I've just written a search which aims to collate IIS crashes to provide an overview of number of crashes versus hour of the day so i can see if there are any regular patterns.

The regex seems to work fine but i can't cluster on the fields extracted by the regex - i have previously done this successfully. Any ideas? My search is:

host="*" earliest_time=-30d sourcetype="WinEventLog:Application" | search Message="Faulting application name: w3wp.exe*" | 
rex field=_raw "(?<i_month>\d{1,2})\/(?<i_date>\d{1,2})\/(?<i_year>\d{2,4}) (?<i_hours>\d{1,2}):(?<i_minutes>\d{1,2}):(?<i_seconds>\d{1,2}).*" | 
cluster field=i_hours t=0.99 countfield=numErrors 
| sort -numErrors | table numErrors i_hours

Many thanks
Neil

Tags (3)
0 Karma

lguinn2
Legend

I am not sure of the answer to your rex problem, but I do have a suggestion for the search -

You may not need the rex. Splunk automatically creates a number of fields from your timestamp: date_mday, date_wday, date_month, date_hour

So your search could be

host="*" earliest_time=-30d sourcetype="WinEventLog:Application" | search Message="Faulting application name: w3wp.exe*" | 
cluster field=date_hour t=0.99 countfield=numErrors 
| sort -numErrors | table numErrors i_hours
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...