topic How to extract new fields? in Splunk Enterprise Security

How to extract new fields?

lucky — Tue, 05 Sep 2023 18:43:08 GMT

HI team,

I need to extract the new fields by using rex for below raw data

1.ResponseCode

2.url

message: INFO [nio-8443-exce-8] b. b. b.filter.loggingvontextfilter c.c.c.c.l.cc.f.loggingcintextfil=ter.post process(Loggingcintextfilter.java"201)-PUT/actatarr/halt/liveness||||||||||||METRIC|--|Responsecode=400|Response Time=0

Re: extract new fields

manjunathmeti — Mon, 04 Sep 2023 05:44:50 GMT

hi @lucky,

Try this:

| rex "\-(PUT|GET|POST|DELETE)(?<url>[\/A-z]+).*Responsecode=(?<ResponseCode>\d+)"

Sample query:

| makeresults | eval _raw="message: INFO [nio-8443-exce-8] b. b. b.filter.loggingvontextfilter c.c.c.c.l.cc.f.loggingcintextfil=ter.post process(Loggingcintextfilter.java\"201)-PUT/actatarr/halt/liveness||||||||||||METRIC|--|Responsecode=400|Response Time=0" | rex "\-(PUT|GET|POST|DELETE)(?<url>[\/A-z]+).*Responsecode=(?<ResponseCode>\d+)"