topic Re: extract field using rex without using _raw in Splunk Search

extract field using rex without using _raw

ksharma7 — Mon, 22 Jun 2020 14:53:23 GMT

I have data like

202-06-19T13:02:293 message="event(level=Error name=xyz)

context: {

Id: 12345,

locale: 'us'

blah blah

My objective is to get error count by corresponding to Id . I have a csv say abc.csv from which I have to look up Id and display result only corresponding to the Id present in csv. moreover for some logs id is logged as field but for some it is not getting logged as field. I used below query:

It is giving me result correctly when I search but when I go and commit it on github it throws error like below :

REX FIELD checks for use of _raw
FAILURE: in file local/searches.conf in section [ABC
Error alert] -> rex field cannot = _raw

Is there any way I can achieve what I want without using _raw and "context" is also not logged as field in logs(fyi)

Re: extract field using rex without using _raw

diogofgm — Mon, 22 Jun 2020 16:12:03 GMT

Hi,

_raw is the default field for rex. You can use the rex command without specifying the field if you are targetting your raw data (e.g. like you are doing). If you want to rex from a table (e.g. stats result) you need to specify the field.

You can always set up a field extraction in props.conf for your sourcetype. This way you don't need to use rex on your search.

What I don't understand is what you mean with an error thrown with the commit to Github. Do you run Splunk app inspect as some sort of workflow action on commit and that's throwing the errors? If that's the case can you post your search stanza ("[ABC Error alert]") from searches.conf?

Regards

Re: extract field using rex without using _raw

ksharma7 — Tue, 23 Jun 2020 05:13:58 GMT

Got it by just removing filed and _raw

|rex "Id:\s*(?<Id>\d+),"