topic field extraction after brackets value in Splunk Search

field extraction after brackets value

indeed_2000 — Sat, 25 Apr 2020 04:50:12 GMT

hi i have log file like below
need to extact the section after first "]" to "[" or "." or ":"

2020-04-24 23:59:59,511 INFO  ABCD.InIT-Service-1234567 [SrvListener] Receive Message[123456789ABCD123E123456789*] from [Service.APP]
2020-04-24 23:59:57,055 INFO  ABCD.InIT-Service-1234567_EFGH.InIT-AppService-5764693 [AbcEndpointManager] Send Message [123456789ABCD123456789123456789*] to A[000] B[0000]
2020-04-24 23:59:59,081 INFO  ABCD.InIT-Host-1234567_EFGH.InIT-Service-1234567 [TopologyProcessorService] Message Processed: A[000] B[0000]
2020-04-24 23:29:59,844 INFO  ABCD.InIT-Service-1234567 [NetworkProcessor] NetworkProcessor Accomplished: A[000] B[0000]
2020-04-24 23:29:59,851 INFO  NAME-1234567 [ExecuteService] CustomeService_clusterCustomeCommand chain was done. Define Parameters[input0='00000',input1='000000']

expected value:

Receive Message
Send Message
Message Processed
NetworkProcessor Accomplished
CustomeService_clusterCustomeCommand chain was done

Thanks

Re: field extraction after brackets value

manjunathmeti — Sat, 25 Apr 2020 08:09:46 GMT

Use rex:

index = INDEX | rex "\]\s(?<message>[\w\s]+)"

Sample query:

| makeresults 
| eval _raw=" _raw
2020-04-24 23:59:59,511 INFO  ABCD.InIT-Service-1234567 [SrvListener] Receive Message[123456789ABCD123E123456789*] from [Service.APP]
2020-04-24 23:59:57,055 INFO  ABCD.InIT-Service-1234567_EFGH.InIT-AppService-5764693 [AbcEndpointManager] Send Message [123456789ABCD123456789123456789*] to A[000] B[0000]
2020-04-24 23:59:59,081 INFO  ABCD.InIT-Host-1234567_EFGH.InIT-Service-1234567 [TopologyProcessorService] Message Processed: A[000] B[0000]
2020-04-24 23:29:59,844 INFO  ABCD.InIT-Service-1234567 [NetworkProcessor] NetworkProcessor Accomplished: A[000] B[0000]
2020-04-24 23:29:59,851 INFO  NAME-1234567 [ExecuteService] CustomeService_clusterCustomeCommand chain was done. Define Parameters[input0='00000',input1='000000']" 
| multikv forceheader=1 
| rex "\]\s(?<message>[\w\s]+)" 
| fields _raw, message

Re: field extraction after brackets value

indeed_2000 — Sat, 25 Apr 2020 15:58:03 GMT

work like charm, thank you 😉