topic Re: How to extract fields from _raw event? in Splunk Cloud Platform

How to extract fields from _raw event?

iamsplunker — Fri, 29 Sep 2023 00:46:24 GMT

Hi Splunkers,

I'm trying to extract the fields from the raw event can you help if this can be done through rex or substr and provide examples if possible.

Sample Event

[August 28, 2023 7:22:45 PM EDT] APPLE Interface IF-abcef23fw2/31 [WAN14] Disabled (100%) Designate that a disabled port or surface is the root cause. This event can be circumvent by setting the SuppressDisabledAlerts to FALSE.

Expected new fields as follows
1 ) Fruit = APPLE
2) Test = Interface IF-abcef23fw2/31 [WAN14] Disabled (100%)
3) Timestamp = August 28, 2023 7:22:45 PM EDT
4) Message = Interface IF-abcef23fw2/31 [WAN14] Disabled (100%) Designate that a disabled port or surface is the root cause. This event can be circumvent by setting the SuppressDisabledAlerts to FALSE.

Please Advise

Re: How to extract fields from _raw event?

bowesmana — Fri, 29 Sep 2023 02:04:57 GMT

Here is an example to get Fruit Timestamp and Message

| makeresults | eval _raw="[August 28, 2023 7:22:45 PM EDT] APPLE Interface IF-abcef23fw2/31 [WAN14] Disabled (100%) Designate that a disabled port or surface is the root cause. This event can be circumvent by setting the SuppressDisabledAlerts to FALSE." | rex "^\[(?<Timestamp>[^\]]*)\] (?<Fruit>\w+)\s+(?<Message>.*)"

it's impossible - without knowing more - to extract Test from Message

You could do this

| rex field=Message "(?<Test>.*100%\))"

but all that is doing is saying that Test will be extracted up to a string ending in 100%)

Does Test have any definining characteristics?

Re: How to extract fields from _raw event?

iamsplunker — Fri, 29 Sep 2023 02:39:01 GMT

Thanks for your response @bowesmana

To answer your question all I wanted to extract is “Test” until 100% from “Interface”

the characteristics are

1)the event may have 30% or 40% instead of 100%

2) Instead of “Interface” it may have string like “Machine” or “Device”

lastly I wanted to save all these Rex as individual inline extractions 1) Fruit 2) Timestamp 3) Test 4) Message so that I don’t have to define |rex at search time.

Re: How to extract fields from _raw event?

bowesmana — Fri, 29 Sep 2023 03:37:58 GMT

So, the regex for the Test extraction is the first part of the message up to a % value, so use this, so it looks for one or more numbers before the %)

| rex field=Message "(?<Test>.*\d+%\))"

As for making them Field extractions, just define them in the field extractions/transforms section of the Fields menu - I think you will have to use 2 extractions as the Test is a subset of the Message, so will require a transform, unless you make 2 regexes to extract first 3 fields then just the Test field