topic Re: Field extraction using rex in Splunk Search

Field extraction using rex

avanijjain16 — Mon, 28 Sep 2020 16:53:51 GMT

Hi,

I am new to splunk, I am trying to extract specific message from my log event. The pattern I am looking from below message

[ERROR] 2020-09-28T11:50:06.108Z 6012c275-5df5-4839-95a0-260057509041 |HLX|Task Failure Occured:{'jobid': 'FLOW-134', 'taskid': 'T-09', 'subtaskid': 'a88f6260-0180-11eb-9ccc-3e5cb494596a'}

I need to extract everything after |HLX| and create another field. Its fine even if it includes |HLX|. I have tried multiple patterns but none are working. Any help would be appreciated.

Thank you.

Re: Field extraction using rex

493669 — Mon, 28 Sep 2020 16:57:40 GMT

@avanijjain16

Can you try below regex-

|rex "HLX\|(?<fieldname>.+)"

Re: Field extraction using rex

inventsekar — Mon, 28 Sep 2020 17:30:34 GMT

Hi @avanijjain16 ... i created a log event with your sample log and ran the rex from @493669 , it works fine. you just have to use the field namev (if ur field name is _raw, simply run "|rex field=_raw.. ") and ".+" or ".*" - both are same.

| makeresults | eval log="[ERROR] 2020-09-28T11:50:06.108Z 6012c275-5df5-4839-95a0-260057509041 |HLX|Task Failure Occured:{'jobid': 'FLOW-134', 'taskid': 'T-09', 'subtaskid': 'a88f6260-0180-11eb-9ccc-3e5cb494596a'}" | rex field=log "HLX\|(?<TaskStatus>.*)" | table TaskStatus

Re: Field extraction using rex

avanijjain16 — Tue, 29 Sep 2020 02:26:46 GMT

So I did some search and found that it’s pre-pattern and then (? Creates new field name TaskStatus that follows HLX and matching with pattern .* (basically everything except /n) . I have some logs where there is chance of \n coming in. It would not match in those cases. Any idea how to allow that. \n can appear any where followed by HLX.

"HLX\|(?<TaskStatus>.*)"

Re: Field extraction using rex

avanijjain16 — Thu, 01 Oct 2020 02:53:08 GMT