topic Re: rex pattern to create a field in Splunk Search

rex pattern to create a field

iamtrying — Thu, 23 May 2019 23:25:00 GMT

Hi,
I have this string in the log.

439 XObk5g6CUI62-gr3UIKfXAAAAAs 1@43465473@A

and I want to create a field out the string in the bold.

Please mind that 439 and 1@43465473@A are not constant.

Thanks for the help!

Saurabh

Re: rex pattern to create a field

nabeel652 — Fri, 24 May 2019 00:09:41 GMT

Try this

| makeresults | fields - _time | eval rawdata="439 XObk5g6CUI62-gr3UIKfXAAAAAs 1@43465473@A" | rex field=rawdata "^\d+\s(?<myField>[^\s]*)\s"

More general regex would be:

| makeresults | fields - _time | eval rawdata="439 XObk5g6CUI62-gr3UIKfXAAAAAs 1@43465473@A" | rex field=rawdata "^.*?\s(?<myField>[^\s]*)"

Re: rex pattern to create a field

vnravikumar — Fri, 24 May 2019 06:31:17 GMT

Hi @iamtrying

Try this also

| makeresults 
| eval msg="439 XObk5g6CUI62-gr3UIKfXAAAAAs 1@43465473@A", result = mvindex(split(msg," "),1)

Re: rex pattern to create a field

iamtrying — Fri, 24 May 2019 16:59:11 GMT

the whole string looks like this

I 2019-05-23 22:27:15.886Z 5960 1712 XOceMpk7Ph@Lna20eJwxXwAAAAU 1@43465473@A WPB-Log: file=/users/source/testr.cls method=testmethod ID= ok=1 ProcessedBankTxnCount=2 TxnRecord=289 NumOfProcessedTxns=1

I am using
rex field=rawdata "^\d+\s(?[^\s]*)\s" | table myField

but it does not match anything.

Am I missing anything?

Re: rex pattern to create a field

nabeel652 — Sun, 26 May 2019 08:47:05 GMT

You need to skip time stamp and then few other fields:

Use this

| makeresults | fields - _time | eval rawdata="I 2019-05-23 22:27:15.886Z 5960 1712 XOceMpk7Ph@Lna20eJwxXwAAAAU 1@43465473@A WPB-Log: file=/users/source/testr.cls method=testmethod ID= ok=1 ProcessedBankTxnCount=2 TxnRecord=289 NumOfProcessedTxns=1" | rex field=rawdata ".*?\s.*?\s.*?\s.*?\s.*?\s(?<myField>[^\s]*)" | table myField