Getting A Specific Field From a Log

luteixeira — Thu, 12 Nov 2020 18:31:38 GMT

Hello Splunkers. 🙂

I have a stream of logs going to Splunk that reports daily errors. The logs is as follows:

Exceptions Details App...............: WebApp Original Message..: The provided anti-forgery token was meant for user "1234" but the current user is "". Server............: WebAppServer Service API URL...: https://xpto.systemname.com/WebAppApi/SelfService/FI.API.SelfService

I have these kinds of exceptions going on through the day and night and my main goal is to compile the type of exception, which URL happened, where (server name) and how many times it happened.

So what I need is to extract the field after the :

I've tried...

index="MyIndex" | extract kvdelim=":", auto=f

... as suggested in this cheat sheet but I couldn't manage to work.

Any help/suggestions? 🙂

Thank you in advance.

Re: Getting A Specific Field From a Log

ITWhisperer — Thu, 12 Nov 2020 19:15:19 GMT

| rex max_match=0 "(?<key>[^\.:\n]+).*:\s(?<value>[^\n]*)"

Re: Getting A Specific Field From a Log

luteixeira — Thu, 12 Nov 2020 20:53:11 GMT

@ITWhisperer You're awesome!

Worked just fine for what I was looking for.

Thank you very much!

topic Re: Getting A Specific Field From a Log in Getting Data In

Getting A Specific Field From a Log

Re: Getting A Specific Field From a Log

Re: Getting A Specific Field From a Log