Splunk Search

Regular expression in log message

nanachu
Path Finder

I'm struggling now.
Could you please help me?

There are two hosts. they have same log data.

the host name is different but the same data is indexed.
host 1 is the master.
If host 1 fails, 2 becomes the master.

If an alert is created as it is, two alerts will be created for the same event. So I am trying to make the same event into one using dedup.

There is a message in the log, only the number changes.

Error message ××× occur

I want to create field to use dedup.
I know it is wrong but I want to do like this one.

message = "Error message \ d \ d \ d occur"
| dedup message

I can't come up with a way.

Could you help me?

Thank you.

0 Karma

aholzel
Communicator

If the number changes than the message is not the same. That is why you still see both messages. What you can do is a replace, to remove the number and than do the dedup. something like this based on the layout of the message field you provided:

| eval message=replace(message, "([^\d]*)(\d*\s*\d*\s*\d*)(.*)","\1\3")
0 Karma

Sfry1981
Communicator

Hi @nanachu

Does what you state about the dedup not work as this should eliminate any duplicate messages and always just pick one from the first host?

Also on the alert you can add a throttle so the same alert is not triggered twice?

You also mentioned about regular expression in the log message. Do you mean you have created a regex to extract from the raw data t get this info?

0 Karma

nanachu
Path Finder

Thank you for helping me.
Sorry, my English is bad.

I can not create field like
because
|eval message = "Error message * * * occur" does not work.
so, I want to know how to create field that put a regular expression in message.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...