topic Re: How to extract a specific data from log in Reporting

How to extract a specific data from log?

thangarun — Fri, 15 Jul 2022 16:52:48 GMT

Dear All,

I am a rookie in Splunk and need your help to extract a fields from the log,

Example:

2022-07-15 14:30:43 , Oracle WebLogic Server is fully supported on Kubernetes , xsjhjediodjde,"approvalCode":"YES","totalCash":"85000","passenger":"A",dgegrgrg4t3g4t3g4t3g4t,rgrfwefiuascjcusc,

In this log i would like to have a extract as Cash and display the value in a tabular form as Date|Passenger|Amount

Please suggest.

Re: How to extract a specific data from log

ITWhisperer — Fri, 15 Jul 2022 07:27:49 GMT

You will need to be more specific

Assuming comma delimited, is the field you are interested in always the 5th field?

Does it always start with "totalCash"?

What would your expected output look like, e.g. does the Cash column always contain "totalCash"?

Do you already have some fields extracted when the events were ingested/indexed?

Re: How to extract a specific data from log

thangarun — Fri, 15 Jul 2022 07:42:55 GMT

Hi @ITWhisperer Sorry for that. No its not the exact 5th field(above is just sample) and expected output is something like this(possible)

Date	Passenger	Cash
15/7/2022	A	85000

Thanks a lot for very quick response.

Re: How to extract a specific data from log

gcusello — Fri, 15 Jul 2022 07:45:31 GMT

Hi @thangarun,

as @ITWhisperer said, it isn't so clear what's the diferene (in your logs) between cash and amount.

Anyway, the regex to extract the totalCash is the following

| rex "\"totalCash\":\"(?<totalCash>\d+)"

that you can test at https://regex101.com/r/KmAhE5/1

Ciao.

Giuseppe

Re: How to extract a specific data from log

gcusello — Fri, 15 Jul 2022 07:49:26 GMT

Hi @thangarun,

update after your message:

| rex "\"totalCash\":\"(?<totalCash>\d+)\",\"passenger\":\"(?<passenger>[^\"]+)"

that you can test at https://regex101.com/r/KmAhE5/2

Supponing that that date and time you have is also the event timestamp, you could run something like this:

index=your_index | rex "\"totalCash\":\"(?<totalCash>\d+)\",\"passenger\":\"(?<passenger>[^\"]+)" | table _time passenger totalCash

Ciao.

Giuseppe

Re: How to extract a specific data from log

ITWhisperer — Fri, 15 Jul 2022 07:54:50 GMT

Depending on your actual data (a single example doesn't really cut it unless it is 100% representative), you may need to deal with decimals

| rex "\"totalCash\":\"(?<totalCash>[\d\.]+)\",\"passenger\":\"(?<passenger>[^\"]+)"

Re: How to extract a specific data from log

thangarun — Fri, 15 Jul 2022 07:57:39 GMT

Awesome....

Re: How to extract a specific data from log

thangarun — Fri, 15 Jul 2022 07:57:59 GMT

Thanks a lot