Splunk Search

Rex for different pattern of same fields within same event

sh254087
Communicator

Trying to formulate a Regex that would work with events something like the below one. When I tried extracting the fields, I did not get to the expected output as the field name I'm looking at is same for values of different pattern. The rex was either failing or throwing error about using duplicate field name.

Sample Event entry:
No machines for project Print-Demo
No machines for project Kimkeen_POC
No machines for project Default Project
Project name: ABCD Life, Machine name:hlstocpra2, Status:STARTED, Backlog bytes:0, Last consistency:Still replicating
Project name: ABCD Life, Machine name:HKWONDERSVD02, Status:PAUSED, Backlog bytes:0, Last consistency:Still replicating
Project name: ABCD Life, Machine name:hlstocpraw2, Status:PAUSED, Backlog bytes:0, Last consistency:Still replicating
No machines for project Print
No machines for project Demo2
No machines for project Test_migrate

Expected extraction and output:
alt text

Looking for help in extracting the fields with all the values to be presented in individual rows.

0 Karma

wenthold
Communicator

I'm not sure if you should use a more complex single rex command, but you can:

| rex "[Pp]roject (?:name: )?(?<ProjectName>[^\,\r\n]+)(?:\, Machine name\:(?<MachineName>[^\,]+)\, Status\:(?<JobStatus>[^\,]+)\, Backlog bytes\:(?<BacklogBytes>[0-9]+)\, Last consistency\:(?<LastConsistency>.*))?"
| table ProjectName, MachineName, JobStatus, BacklogBytes, LastConsistency
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi sh254087,
I suggest to use two different regexes, one for No machines and one for machines the merge machine name fields using coalesce, in othe words:

| rex "(No machines for project )(?<Project_Name1>.*)"
| rex "(?ms)Project name: (?<Project_Name2>[^,]*), Machine name:(?<Machine_Name>[^,]*), Status:(?<Status>[^,]*), Backlog bytes:(?<Backlog_bytes>[^,]*)"
| eval Project_name=coalesce(Project_name1,Project_name2)

you can test it at https://regex101.com/r/X3pgrK/2

Bye.
Giuseppe

0 Karma

sh254087
Communicator

Please help @niketnilay
@shwetas

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...