extract a string from a splunk event

Mohsin123 — Tue, 16 Jan 2018 11:21:22 GMT

Hi ,

Can anyone please give me the props for removing hostname= and path= strings from the below event

hostname=ip-10-13-0-248 path=/var/log/armorvox/2018/01/armorvox.2018-01-16.log 2018-01-16 11:07:20.507 main WARN o.e.j.u.component.AbstractLifeCycle: FAILED org.eclipse.jetty.server.Server@96def03: java.lang.IllegalStateException: no valid keystore
java.lang.IllegalStateException: no valid keystore
at org.eclipse.jetty.util.security.CertificateUtils.getKeyStore(SourceFile:48)
at org.eclipse.jetty.util.ssl.SslContextFactory.loadKeyStore(SourceFile:1030)
at org.eclipse.jetty.util.ssl.SslContextFactory.load(SourceFile:255)

Re: extract a string from a splunk event

mayurr98 — Tue, 16 Jan 2018 12:59:40 GMT

hey you can try this run anywhere search

| makeresults | eval _raw="hostname=ip-10-13-0-248 path=/var/log/armorvox/2018/01/armorvox.2018-01-16.log 2018-01-16 11:07:20.507 main WARN o.e.j.u.component.AbstractLifeCycle: FAILED org.eclipse.jetty.server.Server@96def03: java.lang.IllegalStateException: no valid keystore
java.lang.IllegalStateException: no valid keystore
at org.eclipse.jetty.util.security.CertificateUtils.getKeyStore(SourceFile:48)
at org.eclipse.jetty.util.ssl.SslContextFactory.loadKeyStore(SourceFile:1030)
at org.eclipse.jetty.util.ssl.SslContextFactory.load(SourceFile:255)" | rex field=_raw "^hostname=ip-(?<hostname>[^\s]+)\spath=(?<path>[^\s]+)"

In your environment you should try

<your_base_search> | rex field=_raw "^hostname=ip-(?<hostname>[^\s]+)\spath=(?<path>[^\s]+)"

let me know if this helps !

topic extract a string from a splunk event in Getting Data In

extract a string from a splunk event

Re: extract a string from a splunk event