topic Re: Field Extraction help!!! in Knowledge Management

Field Extraction help!!!

splunker9999 — Wed, 09 Mar 2016 19:25:15 GMT

Hi,

I am newbie to splunk,We are looking to extract a field from below event format.

"PDR Message Listener Completed Processing Message"

From above , we need to extract a field after "PDR Message Listener" as field called status as "Completed", Can someone help extraction using Rex command.

we tried using field extrcation from events ,but it is giving us some false results.

Re: Field Extraction help!!!

somesoni2 — Wed, 09 Mar 2016 19:50:26 GMT

If you always have "PDR Message Listener" before the status value you want to capture, try this

your base search | rex "PDR Message Listener Completed (?<status>\s+)"

If the string before status value is not constant but always 3 words, then try this

your base search | rex "^(\w+\s){3}(?<status>\s+)"

Re: Field Extraction help!!!

vasildavid — Wed, 09 Mar 2016 19:54:27 GMT

I think the capture group should be (?<status>\w+) and not use \s+, right?

edit: formatting

Re: Field Extraction help!!!

MuS — Wed, 09 Mar 2016 19:58:46 GMT

or if you want to use \s then it should be "^(\w+\s){3}(?<status>[^\s]+)"