topic Field Extraction Struggle in Splunk Search

Field Extraction Struggle

sphiwee — Wed, 12 Aug 2020 15:55:34 GMT

i have these log entries, and I'm trying to extract the underlined data as "Business_Process"

i'm using the below regex, on geg101 it extracts just fine but on splunk it exctracts a huge chunk.

rex field=_raw "\Drun\.name\D:\D(?<Business_Process>.+)\D,\Drun.u"

i get below result in splunk

Re: Field Extraction Struggle

richgalloway — Wed, 12 Aug 2020 19:26:05 GMT

Please share your sample data as text rather than a screen shot so people can test with it.

Re: Field Extraction Struggle

thambisetty — Wed, 12 Aug 2020 19:34:56 GMT

| rex “run\.name\”:\”(?<Business_Process>[^\”]+)”

don’t forget to replace double quotes from your keyboard. Double quotes may not match as I am typing from them my phone.

Re: Field Extraction Struggle

sphiwee — Wed, 12 Aug 2020 22:01:12 GMT

wow thanks bro works perfectly, how can i learn to perfect my regex skills?

Re: Field Extraction Struggle

sphiwee — Sat, 15 Aug 2020 17:11:53 GMT

having same issue, trying to extract red text

"run\.author\.fullname\D:\"(?<USER>.+\"\,\"r)"

Re: Field Extraction Struggle

thambisetty — Thu, 13 Aug 2020 06:23:42 GMT

just advice - don't post actual data here.

| rex “run\.author\.fullname\”:\”(?<User>[^\”]+)”

Re: Field Extraction Struggle

sphiwee — Sat, 15 Aug 2020 17:24:28 GMT

Hi thanks for the advice, seem to be getting an error on that regex

Re: Field Extraction Struggle

thambisetty — Sat, 15 Aug 2020 17:27:14 GMT

| rex "run\.author\.fullname\":\"(?<User>[^\"]+)"

try now. the issue is with double quotes, as I had typed them from my phone.

Re: Field Extraction Struggle

sphiwee — Sat, 15 Aug 2020 17:46:11 GMT

Yes I figured it was that, sorry to be bothersome.. any idea how can i vizualize a relationship between Business_Process and User ? i want to show in a cool way which user ran which business process

Re: Field Extraction Struggle

thambisetty — Sat, 15 Aug 2020 20:10:55 GMT

| stats values(Business_process) as business_process by User