Hello
I need some help in fixing the regex for the below events. it works on few and it doesn't on few.
The first event has two lines. Second has a single line event and third is also a single line event with multiple Ip's
**Intel(R) PRO/1000 MT Network Connection** NY12434ABC {"**10.1.1.3**"} 00:12:34:56:78:90
**Intel(R) PRO/1000 MT Network Connection #2** NY12434ABC {"**10.4.5.6**"} 00:12:34:56:78:90
**Intel(R) PRO/1000 MT Network Connection #2** NYAB1234ABC {"**10.1.2.3**"} 00:12:34:56:78:90
**broadway Connection #2** NY1234ABC {"**10.1.1.3**", "**100.66.65.7**","**180.69.65.98**"} 00:12:34:56:78:90
So the regex which I am using is below. It matches for the first line in first event and the second event. So it has to be made repetitive which I am not able to get my mind through even though I have done it few times before. In the third event I want all the three IP's under the field IP_address and I am not sure on how to do it.
(?P<Description>.*)\s+[A-Za-z0-9]{3}\S+\s+\{\"(?P<IP_address>[^\"]+)?\"\}\s+(?P<MAC>\S+)
PS: Please ignore the *
. That's just to give the community an idea on what are the field values which need to be extracted.
Thanks
theou
Try this
..your base search...| rex max_match=0 "(?P<Description>.*)\s+[A-Za-z0-9]{3}\S+\s+\{[\"\*\.\d,\s]+\}\s+(?P<MAC>\S+)"
| rex max_match=0 "\"\*\*(?<IP_address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\*\*\""
Hi theouhuios,
did you try your regex with the argument max_match=0
?
max_match controls the number of times the regex is matched. If greater than 1, the resulting fields will be multivalued fields. Defaults to 1, use 0 to mean unlimited.
hope this helps ...
cheers, MuS
Yes I did try that. it works for the first event , but not or the third one. I am looking for a regex which can match on all three conditions if possible