topic Re: Field extraction in Getting Data In

Field extraction

smanojkumar — Wed, 06 Sep 2023 07:57:49 GMT

Hi Splunkers!
I need to extract the specific field which dosent consists of sourcetype in logs,

Fields to extract - OS, OSRelease

Thanks in Advance,

Manoj Kumar S

Re: Field extraction

gcusello — Wed, 06 Sep 2023 08:01:49 GMT

Hi @smanojkumar ,

if you have the pair fieldname=fieldvalue, you should already have the extraction.

anyway, you could use two regexes like the following:

| rex "OS\=\"(?<OS>[^\"]*)" | rex "OSRelease\=\"(?<OSRelease>[^\"]*)"

Ciao.

Giuseppe

Re: Field extraction

smanojkumar — Wed, 06 Sep 2023 10:17:50 GMT

Hi @gcusello ,

Thanks for your response!

At rare cased we don't have " " in OS and OSRelease, What would be the regex, that should extract in both the cases, Like

OS="Windows", OS=Windows, OSRelease="jhvdhjc", OSRelease=nsvcv

Thanks in advance!
Manoj Kumar S

Re: Field extraction

gcusello — Wed, 06 Sep 2023 10:25:25 GMT

Hi @smanojkumar,

if you don't have quotes, you should be sue about the log forma to find a different rule, could you share some samples of your logs with and without quotes?

Ciao.

Giuseppe

Re: Field extraction

smanojkumar — Wed, 06 Sep 2023 10:32:15 GMT

Without ""

info_search_time=1693969036.181, OS=Linux, isBo=false, isFo=false, SCOPE=Unknown, isVIP=false, OSType=Linux, isCACP=false, isCMDB=false, isLost=false, Country=Unknown, isIndus=false, isMcAfee=true, isStolen=false, OSRelease=Unknown,

With ""

info_search_time=1693969036.181, OS="Windows Server 2019 Standard", isBo=true, isFo=false, SCOPE="IN", isVIP=false, OSType=Win, isCACP=false, isCMDB=true, isLost=false, Country=Germany, isIndus=false, isMcAfee=true, isStolen=false, OSRelease="EL Server 7.4 (Maipo", mcafee_LastCommunication="2023-09-05 20:30:35",

Re: Field extraction

gcusello — Wed, 06 Sep 2023 10:36:15 GMT

Hi @smanojkumar,

in this case, please try this:

| rex "OS\=\"*(?<OS>[^,\"]*).*OSRelease\=\"*(?<OSRelease>[^,\"]*)"

that you can test at https://regex101.com/r/SQFX88/1

Ciao.

Giuseppe