topic Re: rex to extract particular field in Splunk Dev

rex to extract particular field

harishnpandey — Mon, 24 Jul 2017 20:43:13 GMT

Hi ,

I have below string and need to extract field after HCM5250: and before .
Also, while doing search need to consider 65.
Both response Code and responseMessage written on separate lines

65
updateContractTxnAccount Failed - update HCM5250:AD1218494460121708

For e.g:

index=mylog "65" AND "updateContractTxnAccount Failed - update HCM5250:" |rex

Not sure how to get exact rex here . Appreciate your help !!

Thanks ,

Harish

Re: rex to extract particular field

harishnpandey — Mon, 24 Jul 2017 21:01:46 GMT

 <responseCode>65</responseCode>
  <responseMessage>updateContractTxnAccount Failed - update HCM5250:AD1218494460121708</responseMessage>

Re: rex to extract particular field

MuS — Mon, 24 Jul 2017 22:12:52 GMT

Is this an actual sample event you pasted here?

Re: rex to extract particular field

cpetterborg — Mon, 24 Jul 2017 22:31:16 GMT

If your event will have HCM5250 always, then:

rex "<responseCode>(?P<responseCode>\d+)[\s\S]+HCM5250:(?P<responseMessage>[^<]+)<"

rex "<responseCode>(?P<responseCode>\d+)[\s\S]+HCM5250:(?P<responseMessage>\w+)<"

Given the data as shown, either of these should work. If your data for the message is more generic, but you want the : to the end of the XML field, then try:

rex "<responseCode>(?P<responseCode>\d+)[\s\S]+<responseMessage>[^<]*?:(?P<responseMessage>[^<]+)<"

Re: rex to extract particular field

harishnpandey — Tue, 25 Jul 2017 13:29:30 GMT

Below is my exact input stings out of which I need to extract only "AD1218494460121708" which is txn account number..All transaction a/c I need to extract from log

Re: rex to extract particular field

bheemireddi — Tue, 25 Jul 2017 14:22:03 GMT

harishnpandey,

Did you mean to post the actual sample event?

Re: rex to extract particular field

cpetterborg — Tue, 25 Jul 2017 14:44:25 GMT

Here is the rex you need if you only need the last part of the responseMessage:

rex "<responseMessage>[^<]*?:(?P<fieldToBeExtracted_callMeWhatYouWant>[^<]+)<"

That should extract everything from after the colon (:) on to the end of the field.