Here we have extracted the first two characters from each of the “method” field values by the “rex” command. In the above query “method” is an existing field name in “_internal” index and the sourcetype name is “splunkd_ui_access”. Query: index=_internal sourcetype=splunkd_ui_access | rex field=method "(?\w\w).*" | table method, FIRST_TWO_LETTER | dedup method, FIRST_TWO_LETTER Suppose we want to extract the first two characters from any of the existing fields. At last, by the “dedup “ command we have removed the duplicate values. Then by the “table” command, we have taken the “IP” and “DATE”. We have extracted the IP and date from the raw log so we have put “field=_raw” with the “rex” command and the new field names are “IP” and “DATE”. In the above query, we are getting data from the “_internal” index and the sourcetype name is “splunkd_ui_access”. We can extract multiple fields by the Splunk rex command. Then by the “table” command, we have taken “IP” and by the “dedup” command we have removed the duplicate values. We have extracted the ip from the raw log so we have put “field=_raw” with the “rex” command and the new field name is “IP”. Query: index=_internal sourcetype=splunkd_ui_access | rex field=_raw "(?\d+\.\d+\.\d+\.\d+)\s+.*" | table IP | dedup IP Suppose we want to extract 127.0.0.1 as IP. You can also know about : USAGE OF SPLUNK COMMANDS : MVCOMBINE
Then by the “table” command, we have taken “DATE” and by the “dedup” command we have removed the duplicate values. We have extracted the date from the raw log so we have put “field=_raw” with the “rex” command and the new field name is “DATE”.
Query: index=_internal sourcetype=splunkd_ui_access | rex field=_raw ".*\s+\[(?\d+\/\w+\/\d+)\:\d+.*" | table DATE | dedup DATE Suppose we want to extract 08/Sep/2018 as DATE. Suppose we have a data which is coming from any of the indexes. You have to specify any field with it otherwise the regular expression will be applied to the _raw field.įind below the skeleton of the usage of the Splunk “ rex” Command :.This command is also used for replacing or substitute characters or digits in the fields by the sed expression.This command is used to extract the fields using regular expressions.Rex command in splunk is used for field extraction in the search head.Usage of Splunk Rex command is as follows : This topic is going to explain to you the Rex command in Splunk with lots of interesting Splunk Rex examples
0 kommentar(er)
