topic Re: Can you help me with my field extractions? in Splunk Search

Can you help me with my field extractions?

pdantuuri0411 — Thu, 17 Jan 2019 20:19:10 GMT

I have logs from the same source type called log4j in Splunk. The format for the logs is a little different. For example the log formats for data and loglevel are as follows

Log 1 ---- "14:13:00,777 DEBUG"
Log 2 ---- "2019-01-17 14:03:02,013 INFO"

I extracted the field 'loglevel' by adding an entry \s+(?P loglevel [^ ]+)\s from console to the source type and it works perfectly for the example in log 1. However, it doesn't work for Log 2 because of the date, and it considers the time(14:03:02,013) as the log level.

Please advise about what entry should be added to have the loglevel extracted for both the examples.

Re: Can you help me with my field extractions?

Vijeta — Thu, 17 Jan 2019 20:49:11 GMT

This rex expression works for me

| makeresults | eval log1="14:13:00,777 DEBUG"| appendpipe[|eval log1="2019-01-17 14:03:02,013 INFO"]|rex field=log1 "^(\S+\s+){1,3}(?<loglevel>\S+)"

Re: Can you help me with my field extractions?

pdantuuri0411 — Thu, 17 Jan 2019 21:16:16 GMT

@Vijeta, appreciate the quick response.

As I mentioned in my question, the only option I have is to add a field(eg - \s+(?P[^ ]+)\s) in the sourcetype from console. So the answer you provided doesnt work for me. I cannot add rejex.

Re: Can you help me with my field extractions?

Vijeta — Thu, 17 Jan 2019 21:24:18 GMT

@pdantuuri0411 - you can try with ^(\S+\s+){1,3}(?\S+)