topic Re: Extracting Field from 2 different events in Splunk Search

Extracting Field from 2 different events

ralam — Fri, 08 May 2020 19:35:25 GMT

Dear All,

I want to extract fields from the below events. The problem I'm facing is that the fields are not in harmony. For example, in event 1, "action" is the second last key however in event 2, it is the last one.

Similarly, some of the fields that are available in event 2, do not exist in event 1.

Can you guide me in extracting the fields from these events?

Event 1

Fri May 08 11:44:37 PDT 2020|{"timestamp":1588963477939,"caller":"xyz@abc","applicationId":null,"applicationName":null,"action":"LOGIN","message":"User [xyz@abc] logged in successfully"}

Event 2

Fri May 08 18:44:38 UTC 2020|{"timestamp":1588963478783,"caller":"xyz@abc","applicationId":20575244,"applicationName":"TIB_TST","entityType":"APPLICATION","entityId":20575244,"entityName":"TIB_TST","changes":[{"property":"name","value":"TIB_TST"}],"action":"OBJECT_CREATED"}

Re: Extracting Field from 2 different events

richgalloway — Fri, 08 May 2020 20:03:38 GMT

The fields don't have to be in harmony. You can use multiple rex commands to get each one. For example,

<your search> | rex "action\":\"(?<action>[^\"]+)"

Re: Extracting Field from 2 different events

ralam — Fri, 08 May 2020 21:07:02 GMT

Thank you @richgalloway. I have always believed that the bigger question has always a smaller answer.
Your answer solved my bigger issue. However, one small problem, using your method I extracted many fields but facing a weird issue with "entityId":20575244. I used "entityId\":(?<entityId>\d+)" for it which worked in search but the same failed while applying in the Field Extractor application. It could not match to a single event.

Re: Extracting Field from 2 different events

richgalloway — Sat, 09 May 2020 00:02:28 GMT

The field extractor may not like the escaped quote.