About mikecal

mikecal · ‎01-05-2023

Thanks @richgalloway and @gcusello for your quick replies! Ultimately, Rich's search served my needs best. One funny oddity, I needed to use the dash after the stanza as a delimiter and lookahead worked just fine in that capacity. index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS | rex field=_raw "Filename\([\d-]+(?<phoneid>[A-Z]{3}.*(?=-))" | stats count by phoneid

mikecal · ‎01-04-2023

I'm trying to use the following search to capture information regarding an identification code: index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS | rex field=_raw "Filename(?<phoneid>)(?=[A-Z][A-Z][A-Z]).*(?=-)" | stats count by phoneid Here an example of the log entry: 2023-01-04 15:08:09.001175 DEBUG [0xce4] VoiceRecorderUpdateTask.cpp[28] VoiceRecorderUpdateTask::runTask: MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS : Filename(4281-1672873674000-4125-SEP12345678-98962688) I want to capture the information from the 4th stanza. I'm trying to use lookahead to target the three alpha characters. This works as expected in regex101.com but Splunk is not producing any results. I've read in several articles that lookahead doesn't work as you would expect it to but I haven't been able to piece together a search that will work. Maybe I'm going about this the wrong way. Any help is appreciated. Thanks, Mike

mikecal · ‎10-12-2019

Thanks for your reply. The value for keepevicted is non zero and for some reason keeporphans returns no value at. The problem I see with the keepevicted approach is that it cannot distinguish between startswith and endswith. I only want to ignore incomplete transactions where endswith is present with no startswith. However, I do want to know when a startswith value is found and no endswith value is found. When I set keepevicted to false, both endswith and startswith are ignored.

mikecal · ‎10-11-2019

I have an issue where my transaction search finds endswith events with no startswith events. Not to go into too much detail but this is due to a funky way that Cisco logs OSPF events when DMVPN is involved. I want to simply ignore endswith matches if a startswith event doesn't exist. Is there a way to force transaction to only match if a startswith event exists (must startswith)? Below is my search: sourcetype=cisco:ios eventtype="cisco_ios-routing-ospf" | transaction host startswith="FULL to DOWN" endswith="LOADING to FULL" keepevicted=true | search closed_txn=0 Thanks, Mike

Posts	4
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎10-11-2019

Online Status	Offline
Date Last Visited	‎01-05-2023 04:06 PM

How to use regex lookahead to capture the informat...

How to get transaction to ignore endswith if start...

Re: Regex lookahead issue

How to use regex lookahead to capture the informat...

Re: How to get transaction to ignore endswith if s...

How to get transaction to ignore endswith if start...