Splunk Search

Rex not iterating over large string

evan_roggenkamp
Path Finder

I am trying to use rex to extract the hostnames and put them in a table, but rex is only matching the first string and then it stops

rex "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name

The data is part of a job log I am ingesting files and directories input.

The textfile is formatted like this:

___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.mrcl1.domain.net (10.140.255.7):
 ERROR: Cannot download Running config : Connection Refused by 10.140.255.7
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.abvl1.domain.net (10.252.255.50):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.blvw1.domain.net (10.196.255.5):
downloaded Running config
__________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.clem1.domain.net (10.196.255.1):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.domain.net (10.140.255.9):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.drck1.domain.net (10.132.255.3):
downloaded Running config
___________________________________________________________________________

I did have to clean this file up with python before getting it into splunk, so if some kind of text operation/reorganization would help this go more smoothly that is definitely an option.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The rex command by default matches only one. Use max_matchoption to increase that limit

 ...| rex max_match=100 "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name

View solution in original post

gcusello
SplunkTrust
SplunkTrust

try this

HOSTNAME:\s+(?<myfield>[^ ]+)/g

you can test it on https://regex101.com/
Bye.
Giuseppe

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The rex command by default matches only one. Use max_matchoption to increase that limit

 ...| rex max_match=100 "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...