Splunk Search

Need help on rex

bzwick
New Member

Hi there,

I have nagios events like these ones:

[1390906919] SERVICE ALERT: hostname;Interface 10;CRITICAL;SOFT;2;CRIT - vif1 MAC: xx:xx:xx:xx:xx:xx, 1.41GBit/s, in: 1.13MB/s(0.7%), in-errors: 0.23%(!!) >= 0.1, out: 10.38MB/s(6.2%)

To create daily statistics I need a regex on the hostname which has to contain words like "lin", "win", "esx", ...

I am kinda stuck on this one, so any help would be appreciated.

Tags (3)
0 Karma

hRun
Path Finder

To match any hostname in this specific example

EXTRACT-hostname = (?i)^\[\d+\]\s[^:]+:\s(?P<hostname>[^;]+);  

is the entry you would want to make in your props.conf.

To make restrictions to the possible hostnames change the part in between < hostname> and the closing bracket, or post some more examples.

Hope this helps

kristian_kolb
Ultra Champion

Since this piece of information seems to be located in the beginning of the event, is should be fairly easy to extract it. For the sample event given above, the following would work;

... | rex "\S+\s+\S+\s+(?<hostname>\w+);"

This will extract the hostname from the event, regardless of contents of the string. Then you can do the sorting/filtering/statistics as part of the query.

If you need to categorize by OS, and if this information can be deduced from the hostname, you can set this up with eval functions such as case;

.... | eval category = case(match(hostname, "win"), "Windows", match(hostname,"lin"), "Linux",match(hostname,"esx"),"ESX",1=1,"Other")

then do your statistics reporting with the category field.

Hope this helps,

K

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...