Splunk Search

Is it possible to reuse a field regex in multiple alerts?

tescowill
New Member

We have a large number of alerts which extract data from nginx logs and ping under certain conditions. In each of these alerts we do an identical field regular expression extraction to break the log down into variables, e.g.:

rex field=_raw "\s(?<http_code>\d\d\d)\s(?<response_time>\d+(\.\d*)?|\.\d+)\s"

Is there a way to save and reuse this field extraction so I can use it in a number of alerts, or do I need to duplicate it in each one?

0 Karma

jpolvino
Builder

How about making it a macro? Make it global or scoped to an app, and then call it with:

`macroname`
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...