topic Re: Extract field with rex in Splunk Enterprise

How to extract field with rex?

altink — Tue, 17 Jan 2023 20:19:05 GMT

Dear All.

When searching some database log as
index=my_db ....
I have a field named "statement" with content as example below:

The login packet used to open the connection is structurally invalid; the connection has been closed. Please contact the vendor of the client library. [CLIENT: 192.20.21.22]

I need to create a new field, named IP2, with the IP address as above.

In general, the rex command must look for the text between "[CLIENT: " and "]"

Your help is appreciated

best regards
Altin

Re: Extract field with rex

kamlesh_vaghela — Tue, 17 Jan 2023 18:28:32 GMT

@altink

Are you looking for this?

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Extract field with rex

altink — Tue, 17 Jan 2023 18:40:31 GMT

I am not getting:

Why makeresults should be there
I have an existing field "statement" from which I need to get the IP, instead of a _raw one
Do not understand part "rename comment .." - I have no field named "comment"

referring to part
eval raw="[CLIENT: 192.20.21.22]"

part 192.20.21.22 is NOT fixed, it is just from the example above, it is variable - what I want to get as field IP2

regards
Altin

Re: Extract field with rex

bowesmana — Wed, 18 Jan 2023 02:22:45 GMT

When people reply with solutions they will often post a block of code starting with | makeresults, which means this is an example which you can copy/paste to a Splunk search window and run to demonstrate the solution.

If you do that, you will see that it will create a dummy example and then extract a new field called IP2 with the address as need. The "rename..." is simply telling you that up to the final line, is an example setting up a solution for you.

As @kamlesh_vaghela has shown, the last line is the rex statement you need.

Re: Extract field with rex

altink — Wed, 18 Jan 2023 16:51:31 GMT

Thank you for your answer too

regards
Altin

Re: Extract field with rex

altink — Wed, 18 Jan 2023 16:55:29 GMT

Thank you very much for the solution

regards
Altin

ps. upvote is "accept as solution"?