Splunk Search

How to Combine Two Regex to Form One Variable

jepoyyyy
Explorer

Hi all,

I have events similar to these:

[10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000001
[10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000001
[10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000002
[10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000002

My objective is to extract TrxThread and subsNumber (ex. 1000000001) and combine them into one variable so that I could differentiate each transaction even though they have the same TrxThread

My end goal is to measure the duration so I'll be using the search below once I get the combined transaction thread and subs number
| stats earliest(_time) as start latest(_time) as end by combined_trx_id | eval dur=end-start

Thanks in advance!

Kindest regards,
Jeff

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

Try like this

.... | rex "Thread\((?<tid>\w+).*for\s(?<id>\d+)$" | eval combined_trx_id=tid."::".id

View solution in original post

sundareshr
Legend

Try like this

.... | rex "Thread\((?<tid>\w+).*for\s(?<id>\d+)$" | eval combined_trx_id=tid."::".id

jepoyyyy
Explorer

it worked perfectly. Thanks a lot sir!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...