Splunk正则表达式以查找数据

Question

我试图从下面的日志中找到x-sw-客户端标识值，即自助服务-自动化。键总是相同的，但是值将根据客户端的不同而不同。你能建议我一个正则表达式或查询来找出有多少客户访问我的服务吗？

POST : http://selfservice.host.io/service
36677 > host: billing-host.io
36677 > user-agent: unirest-java/1.2.11 32322 > x-key: self-service 
36677 > x-app-name: Self_Service_Consumer
36677 > x-sw-client-id: self-service-automation
36677 > x-forwarded-for: 111.111.110.134, 120.24.519.232, 110.423.232.432 
36677 > x-forwarded-host: api-qa-self-service.host.io 
36677 > x-forwarded-port: 443

Answer 1

尝尝这个。您的新字段名将是"ClientID“

... | rex x\-sw\-client\-id\:\s(?<ClientID>\S+)