topic Re: Extracting fields from HTML event in Splunk Enterprise

How to extract fields from HTML event?

bmanikya — Tue, 18 Apr 2023 15:47:47 GMT

Below is the sample HTML event

<HTML><BODY><TABLE border="1"><TH style=background-color:#00FFFF>Cluster</TH><TH style=background-color:#00FFFF>BlockSize</TH> <TR bgcolor=#ABEBC6><TD>GCS E1</TD><TD>41008</TD></TR><TR bgcolor=#ABEBC6><TD>VPay E1</TD><TD>18994</TD></TR><TR bgcolor=#ABEBC6><TD>Cadence E1</TD><TD>35345</TD></TR><TR bgcolor=#ABEBC6><TD>GCODS E1</TD><TD>3312</TD></TR><TR bgcolor=#ABEBC6><TD>EDMS E1</TD><TD>3715</TD></TR><TR bgcolor=#ABEBC6><TD>Nemo E1</TD><TD>3366332</TD></TR></TABLE></BODY></HTML>

Need a splunk query to extract above HTML event and output should be below.

Cluster	BlockSize
GCS E1	41008
VPay E1	18994
Cadence E1	35345
GCODS E1	3312
EDMS E1	3715
Nemo E1	3366332

@links

Re: Extracting fields from HTML event

manjunathmeti — Tue, 18 Apr 2023 12:20:47 GMT

hi @bmanikya ,

Try this query:

| rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>" | eval zip=mvzip(Cluster, BlockSize) | mvexpand zip | eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)

Testing sample:

| makeresults | eval _raw="<HTML><BODY><TABLE border=\"1\"><TH style=background-color:#00FFFF>Cluster</TH><TH style=background-color:#00FFFF>BlockSize</TH> <TR bgcolor=#ABEBC6><TD>GCS E1</TD><TD>41008</TD></TR><TR bgcolor=#ABEBC6><TD>VPay E1</TD><TD>18994</TD></TR><TR bgcolor=#ABEBC6><TD>Cadence E1</TD><TD>35345</TD></TR><TR bgcolor=#ABEBC6><TD>GCODS E1</TD><TD>3312</TD></TR><TR bgcolor=#ABEBC6><TD>EDMS E1</TD><TD>3715</TD></TR><TR bgcolor=#ABEBC6><TD>Nemo E1</TD><TD>3366332</TD></TR></TABLE></BODY></HTML>" | rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>" | eval zip=mvzip(Cluster, BlockSize) | mvexpand zip | eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)

Re: Extracting fields from HTML event

bmanikya — Thu, 14 Sep 2023 11:24:55 GMT

How to split the above table in one line each and wanted to have threshold if the current Block size exceeds Max Block size i.,e (85%) i want to trigger alert

Re: Extracting fields from HTML event

ITWhisperer — Thu, 14 Sep 2023 11:38:54 GMT

| eval zip=mvzip(Cluster, Current, Max) | mvexpand zip | eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2)

Re: Extracting fields from HTML event

bmanikya — Thu, 14 Sep 2023 12:51:59 GMT

It is not working since mvzip will process only X and Y fields. It worked with the below.

eval zip= mvzip(mvzip(Cluster,Current),Max)|mvexpand zip|eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1),Max=mvindex(zip, 2)

I am left with threshold, if the current is above 85% than Max, it should trigger an alert.

Re: Extracting fields from HTML event

ITWhisperer — Thu, 14 Sep 2023 13:15:43 GMT