Splunk Search

multiple output rex with a directory sometimes exists

fritzsplunk
Engager

Hi

I have a question about a rex with multiple outputs. I use rex to get two fields out of the source-path to fill them into a new field.

The complete source for Weblogic is /appl/midw/wls/<midw_appl>/<midw_node>/<midw_appl>/pf-midw/logs/gc.log.
For Tomcat the secound directory 'midw_appl' is not used: /appl/midw/tc/<midw_appl>/<midw_node>/pf-midw/logs/gc.log

We can use rex field=source /appl/midw/"(wls|tc)"/(?<midw_appl>\w+.*)/(?<midw_node>\w+.*)/.*/pf-midw/logs/gc.log to get Weblogic corretly and rex field=source /appl/midw/"(wls|tc)"/(?<midw_appl>\w+.*)/(?<midw_node>\w+.*)/pf-midw/logs/gc.log to get Tomcat correctly.

So, I am searching for a solution e.g. to start rex matching at the beginning of the source field or a way to stop the first output at / to get both of them.

I would be pleased if anybody have an good idea for this issue!

Thanks and best regards,
Fritz

0 Karma
1 Solution

fritzsplunk
Engager

The answer in this case is:
rex field=source (\/\w+){3}\/(?"[a-zA-Z0-9-]"+)\/(?"[a-zA-Z0-9-]"+)\S+

View solution in original post

0 Karma

fritzsplunk
Engager

The answer in this case is:
rex field=source (\/\w+){3}\/(?"[a-zA-Z0-9-]"+)\/(?"[a-zA-Z0-9-]"+)\S+

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...