Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to extract the protocol, Device_IP, transaction sequence number and the message type with regex

$
0
0
I have a field called File_Name that I've generate by trimming the filepath off of my source from a local data input. The files are either XML or txt files but the names all follow the same format. They contain the protocol, Device IP, A three-part transaction sequence number and a message type. Example: **TCP_10.101.100.111_1478-1573570987-8723-DeviceToNCE.xml** I want to extract the protocol, Device_IP, the first two parts of the transaction sequence number (for event correlation) and the message type. Here's what I've written so far, forgive me if it's inelegant, I'm still learning! | rex File_Name="(?\w+)_(?\d+\.\d+\.\d+\.\d+)_(?\d+\-\d+)-\d+-(?\w+\.\w+)"

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>