topic does not appear in the field in Splunk Search

does not appear in the field

nanachu — Fri, 01 Nov 2019 08:39:55 GMT

Hi all

I have event like that.
2019-10-26 15:00:09.158, servicename="ROOT2", area="SCP", place="tokyo", path="AAA12345", Default="B", Sn="B", SC="B", update="person"

"path" "place" "area" "servicename" and "Sn" are automatically appear in the field.
When a field is specified, a value such as B appears.

But 　"SC" did not appear automatically. I think it is few.

I need value like B.
I want to make table.

index=main |table path, area, Sn, SC

path,area,Sn,SC
AAA12345,tokyo,B,B
AAA23456,osaka,A,A
AAA34567,nagoya,C,A

What should I do?

Thank you for helping.

Re: does not appear in the field

ansusabu — Fri, 01 Nov 2019 08:59:42 GMT

You can use regex in the query for extracting 'SC' value.
ex:

SC=\"(?<sc>\w*)\"

Re: does not appear in the field

nanachu — Tue, 05 Nov 2019 01:23:55 GMT

Thank you for helping.
but, it does not work well.

Re: does not appear in the field

woodcock — Tue, 05 Nov 2019 03:07:39 GMT

Add this as the first pipe in your SPL:

... | rex "SC=\"(?<SC>[^\"]+)\" ...

Re: does not appear in the field

nanachu — Wed, 06 Nov 2019 09:10:30 GMT

when I used |rex field=_raw
It work well.
Thank you.