topic Re: How to extract event_id and STATUS? in Splunk Search

How to extract event_id and STATUS?

jayakumar89 — Mon, 30 Oct 2017 17:53:43 GMT

I have a single row event that populates the below values and i would like to extract eventid=389643 and STATUS=FINISHED using regex. Could you help me with the regex pattern to extract these values.

2017-10-30 06:48:03,357 [pool-22-thread-1] INFO xxxxxxxxxxxxxxxxxxxxxxx - Email Sent
To : xxxxxxxxxxxxxxxxxxxxxxxx
From : xxxxxxxxxxxxxxxxxxxxxxxxxxxx
Subject : Plan Status - 389643 FINISHED
Body : Plan Status - 389643 FINISHED

Re: How to extract event_id and STATUS?

s2_splunk — Mon, 30 Oct 2017 17:59:39 GMT

Try this: <yoursearch> | rex field=_raw "(?<eventID>\d+)\s(?<STATUS>\w+)$"

This assumes that there is nothing in the event after your status value (the RegEx anchors to the end of _raw)

Re: How to extract event_id and STATUS?

skoelpin — Mon, 30 Oct 2017 18:02:16 GMT

Try this

| rex Status\s\-\s(?<eventid>\d+)

| rex -\s\d+\s(?<STATUS>\w+)

Re: How to extract event_id and STATUS?

cpetterborg — Mon, 30 Oct 2017 18:16:27 GMT

... | rex "Subject : Plan Status - (?<eventID>\d+)\s(?<STATUS>\w+)"

will work if you have additional stuff after that last line.