Parse some text from log

claudio9494 — Wed, 06 Feb 2019 10:20:36 GMT

Hi everyone,
i've got some log like this:

[2019-02-01 14:51:43][P][APPLICATION/controllers/access_controller.php:166  in access_controller::_get_authenticated_user()] [24418549=Laetitia resoludor] _get_authenticated_user -> session_start
[2019-02-01 14:51:43][P][APPLICATION/mappers/exam_mapper.php:15 SQL->query_single_row()  in exam_mapper::getExam()] [24418549=Laetitia resoludor] [DB] INIT: mysql:host=hidden.com;dbname=myapp
[2019-02-01 14:51:43][P][APPLICATION/mappers/exam_mapper.php:15 SQL->query_single_row()  in exam_mapper::getExam()] [24418549=Laetitia resoludor] [SQL][myapp/mysql] 
SELECT *
        FROM app_exam 
        INNER JOIN  app_qcm ON app_exam.id_qcm = app_qcm.id_qcm
        WHERE app_exam.id_exam = 4506873

[2019-02-01 14:51:43][P][APPLICATION/mappers/exam_mapper.php:15 SQL->query_single_row()  in exam_mapper::getExam()] [24418549=Laetitia resoludor] [SQL][myapp/mysql] 
[2019-02-01 14:51:52][P][APPLICATION/mappers/exam_login_mapper.php:231 SQL->query_all()  in exam_login_mapper::selectAllByIdExamWithoutXML3()] [24418549=Laetitia resoludor] [SQL][myapp/mysql] 
SELECT id_exam_sheet,  points, note, current_question, total_question,options
        FROM app_exam_login
        INNER JOIN app_exam_sheet ON app_exam_login.id_exam_login = app_exam_sheet.id_exam_login
        where app_exam_login.id_exam=4506873
        order by id_exam_sheet;

i need to parse the [24418549=Laetitia resoludor] the field inside the box bracket (numberfield=name) can change,
how i can do that?
i've find a regex that can do that "[0-9]\d+=([A-Z])\w+ \w+" how i can apply that to splunk search and reporting?

Re: Parse some text from log

rshah_splunk — Wed, 06 Feb 2019 12:45:17 GMT

You can use rex command to accomplish your task.

Ex. | rex field=_raw "[0-9]\d+=(?[A-Z]\w+\s+\w+)"

This will extract the value in field called "myfield"
Reference: https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Rex,

Re: Parse some text from log

claudio9494 — Wed, 06 Feb 2019 15:20:15 GMT

thanks, how i can extract from all event ?

Re: Parse some text from log

rshah_splunk — Thu, 07 Feb 2019 11:02:25 GMT

All event means ? Can you help me understand ?
Just to note that as we have provided field=_raw, we will be applying that regex on entire raw event.

topic Parse some text from log in Getting Data In

Parse some text from log

Re: Parse some text from log

Re: Parse some text from log

Re: Parse some text from log