All Apps and Add-ons

How to extract field from sentence?

sjnorman
Explorer

I'm trying to write a field extraction to get the number of hung threads on a WebSphere application server. The log statement looks something like:

[6/15/14 11:07:37:103 CDT] 00000003 ThreadMonitor W WSVR0605W: Thread "WebContainer : 21" (000000a3) has been active for 729415 milliseconds and may be hung. There is/are 3 thread(s) in total in the server that may be hung.

I want to key in on the following section: There is/are **3* thread(s)*

If I pipe search results into the rex, the value is successfully extracted into a field called hung_thread_count:

<search criteria> | rex field=_raw \sThere is\/are \(?<hung_thread_count>.*?\) thread"

However, when I manually enter the regex into the interactive field explorer no matches are found when I hit the "test" button...do I have to enter something specific to extract this value into a field?

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

you are missing double quoted and they are too many escape characters in the regex, especially on the matching parenthesis.

try

... | rex field=_raw "There is\/are (?<hung_thread_count>\d+) thread"

View solution in original post

yannK
Splunk Employee
Splunk Employee

you are missing double quoted and they are too many escape characters in the regex, especially on the matching parenthesis.

try

... | rex field=_raw "There is\/are (?<hung_thread_count>\d+) thread"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...