topic How to covert raw log to specific fields? in Alerting

How to covert raw log to specific fields?

splunklearner99 — Mon, 05 Dec 2022 12:50:59 GMT

Hello Champs..

One of the splunk log is having below field

Text: XCOM: File Receive ended REQ 086094, Remote LU 10.38.46.122, File $PRD10.C221130A Remotefile /ABC/APP1/OUT/C221130A 63465 bytes, 578 records in 38875 microsec

I want to extract File_name = $PRD10.C221130A and Remote_file = /ABC/APP1/OUT/C221130A and records = 578 from above Text filed. How this can be done? Please help

Re: How to covert raw log to specific fields

ITWhisperer — Mon, 05 Dec 2022 08:06:41 GMT

| rex "File\s(?<File_name>\S+)\s*Remotefile\s(?<Remote_file>\S+).+(?<records>\d+)\srecords"

Re: How to covert raw log to specific fields

splunklearner99 — Mon, 05 Dec 2022 12:00:47 GMT

Thanks @ITWhisperer , the query is giving below result

File_name = $PRD10.C221130A

Remote_file = /ABC/APP1/OUT/C221130A

rerecords = 3

For records your query is taking the first byte of microsecond, expected 578 records

raw log: File $PRD10.C221130A Remotefile /ABC/APP1/OUT/C221130A 63465 bytes, 578 records in 38875 microsec

Re: How to covert raw log to specific fields

ITWhisperer — Mon, 05 Dec 2022 12:12:33 GMT

Try this - note the ? after the .+

| rex "File\s(?<File_name>\S+)\s*Remotefile\s(?<Remote_file>\S+).+?(?<records>\d+)\srecords"

Re: How to covert raw log to specific fields

splunklearner99 — Mon, 05 Dec 2022 17:49:55 GMT

thanks @ITWhisperer , Similarly would be able to help for thisText: CBM042 CEDBatch finished, Chg=B221205D, Recs=2581, Errs=8

Where I need

Status = CEDBatch finished

Records = 2581

Errors =9

Change = B221205D

@ITWhisperer

Re: How to covert raw log to specific fields

ITWhisperer — Mon, 05 Dec 2022 17:57:17 GMT

| rex "\w+\s(?<status>[^,]+), Chg=(?<change>\w+), Recs=(?<records>\d+), Errs=(?<errors>\d+)"

https://regex101.com/r/nbhKPz/1