topic Re: How do I extract a field from another field? in Splunk Search

How do I extract a field from another field?

rohinisb91 — Tue, 11 Dec 2018 00:28:00 GMT

I have an event in the following format

2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO  com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC

These are already part of the "message" field. How do I extract npid, groupId, dom, source as different fields? These should be extracted as fields going forward.

Any pointers are appreciated!

Re: How do I extract a field from another field?

ddrillic — Tue, 11 Dec 2018 00:54:34 GMT

Something in the spirit of .*source=(?<source>\w*).*dom=(?<dom>\w*)...

Re: How do I extract a field from another field?

adonio — Tue, 11 Dec 2018 01:02:26 GMT

hello there:

runt this search anywhere:

| makeresults count=1
| eval _raw = "2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO  com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC"
| rex field=_raw "(?<time>\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2})\s+\[(?<something>[^\[]+)\[(?<some_digits>[^\]]+)\]\]\s+(?<log_level>[^\s]+)\s+(?<some_fqdn_maybe>[^\:]+)\:(?<maybe_port>\d+)\s\-\s(?<everything_elde>.+)"
| extract pairdelim="|", kvdelim="=:"

to make it permanent use props.conf
you can also use the interactive field extractor

hope it helps

Re: How do I extract a field from another field?

saurabhkharkar — Thu, 27 Dec 2018 14:06:41 GMT

| makeresults 
| eval message="2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO  com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC"
|rex field=message ".*Bolt\=(?<Bolt>[^\|]+)"
|rex field=message ".*source\=(?<source>[^\|]+)" 
|rex field=message ".*dom\=(?<dom>[^\|]+)" 
|rex field=message ".*groupId\=(?<groupId>[^\|]+)" 
|rex field=message ".*npid\=(?<npid>[^\|]+)" 
|table message Bolt source dom groupId npid