topic extract custom filed and display value in the table output in Splunk Search

extract custom filed and display value in the table output

narenpg — Wed, 30 Sep 2020 05:22:29 GMT

Query
index=java networkenv=prod stackenv=prod source="/opt/jboss/standalone/custom_engine.log"
|convert ctime(_time) as time timeformat="%m/%d/%Y %H:%M:%S"
|rex field=_raw ""orderEnteredBy":\"(?[^\"]+\")"
|table time orderEnteredBy

It matches the word orderEnteredBy but when i tried to get the name into the table it shows empty..

Here is the log
availableBalance":{},"projectedBalance":{}}},"productSummary":{"symbol":"RPACX","displayValue":"RPACX","cusip":"32254T759","assetType":"MUTUAL_FUND","description":"UFACRESCENT FUND N/L","settlementDuration":4,"omnibusProduct":true},"orderEnteredBy":"JANEDOE","orderUpdatedBy":"SYS_USER","dirtyFSTT":false,"messagesSummary":{"messagesCount":2,"errorsCount":0,"warningsCount":0,"infosCount":0},"assetType":"MUTUAL_FUND","fundServTransactionTypeDetails":{"cdscValueOverridable":false,"netAssetValue":"NAV_OTHER","rightsOfAccumulation":{"additionalHoldings":0,"manualOverride":false,"additionalHoldingsValid":true}

Re: extract custom filed and display value in the table output

narenpg — Wed, 06 May 2020 15:40:51 GMT

Somehow the name value is missed from my post
|rex field=_raw ""orderEnteredBy":\"(?[^\"]+\")"

Re: extract custom filed and display value in the table output

gcusello — Wed, 06 May 2020 15:45:48 GMT

Hi @narenpg,
to display code use the Code sample button (the one with 101010)
Anyway the correct search should be:

index=java networkenv=prod stackenv=prod source="/opt/jboss/standalone/custom_engine.log"
| convert ctime(_time) as time timeformat="%m/%d/%Y %H:%M:%S"
| rex "\"orderEnteredBy\":\"(?<orderEnteredBy>[^\"]*)\""
| table time orderEnteredBy

You can test the regex at https://regex101.com/r/5D8hAf/1

Ciao.
Giuseppe

Re: extract custom filed and display value in the table output

narenpg — Wed, 06 May 2020 15:57:59 GMT

I did use the regex101 for this.. After using your regex, i am still not seeing the output for the table orderEnteredBy. Do i have to use makeresults

Re: extract custom filed and display value in the table output

narenpg — Wed, 06 May 2020 15:58:34 GMT

Oops Sorry it is working... There was a typo.. Thanks a lot

Re: extract custom filed and display value in the table output

gcusello — Wed, 06 May 2020 16:04:47 GMT

Hi @narenpg,
no makeresuts generates the specified number of search results, you have to use your search,
did you're using a Fast Mode or a Verbose Mode?
If Fast, try Verbose.

Ciao.
Giuseppe