Hello,
I have the following event:
X Mon Mar 4 19:57:48:935 2019 X *** WARNING => MMX 'EGPH5': mm_diagmode set 0 118: possible performance degradation #102400
WARNING could be also ERROR, I would like to handle both cases in one regex.
Now, I would like to:
1/ Skip the line beginning until the word WARNING / ERROR
2/ clear the event from all digits
3/ save the result into the "text"
For the digit clearing I have the following replace:
| eval text=replace(_raw,"\d{0}\d+","")
and it works fine. However I have issues with the skipping line until WARNING / ERROR. If I take the regex101, then the corresponding sed would be:
s/^(.*)\* //g
but when I apply it in the Splunk SPL it will do nothing:
| rex mode=sed "s/^(.*)\*//g"
.. not mentioning trying above in replace.
Could you please advice?
How would I skip the beginning of line and clear it from digits and assign to the text? Replace or sed, does not matter.
Kind Regards,
Kamil
Hi @damucka
Try like and please let me know sample output that you want
| makeresults
| eval _raw="X Mon Mar 4 19:57:48:935 2019 X *** WARNING => MMX 'EGPH5': mm_diagmode set 0 118: possible performance degradation #102400"
| eval text=replace(_raw,"\d{0}\d+","")| rex field=text mode=sed "s/^(.*)\*//g"
What about this:
|makeresults | eval _raw = "X Mon Mar 4 19:57:48:935 2019 X *** WARNING => MMX 'EGPH5': mm_diagmode set 0 118: possible performance degradation #102400" | rex mode=sed field=_raw "s/\d+//" |rex mode=sed "s/^(.*?)\*+//g"
Hi @damucka
Try like and please let me know sample output that you want
| makeresults
| eval _raw="X Mon Mar 4 19:57:48:935 2019 X *** WARNING => MMX 'EGPH5': mm_diagmode set 0 118: possible performance degradation #102400"
| eval text=replace(_raw,"\d{0}\d+","")| rex field=text mode=sed "s/^(.*)\*//g"