topic Re: splunk in Splunk Search

splunk

vinod_52791 — Fri, 09 Oct 2020 10:43:25 GMT

I have logs like below

Email information for the template:payment_receipt_ppo_1 Posted Successfully with status:200

Email information for the template:DEV_1 Posted Successfully with status:200

Email information for the template:payment_1 Posted Successfully with status:400

i want to display like below

template

----------
payment_receipt_ppo_1
DEV_1
payment_1

Re: splunk

ITWhisperer — Fri, 09 Oct 2020 11:00:44 GMT

| rex "template:(?<template>\S+)"

Re: splunk

vinod_52791 — Fri, 09 Oct 2020 11:22:34 GMT

If i place the above field i.e "

template:(?<template>\S+)

I am getting below result

payment_receipt_ppo_
DEV_
payment_

so i noticed afer backspace 1 is missing for some logs and for some logs (if the value is dev template) i am getting dev only after space I.e remplate is missing in the result

Re: splunk

vinod_52791 — Fri, 09 Oct 2020 11:25:32 GMT

i want full value like below

payment_receipt_ppo_1
DEV_1
payment_1

and one more thing space separated string is also not appearing

for example if i hav evalue is log is template:dev value

but i am getting dev only

please suggest any solution

Re: splunk

ITWhisperer — Fri, 09 Oct 2020 11:33:51 GMT

Please show the logs that are not working in a code block (use </> above to insert the code block). This is so that it isn't formatted and potentially removing spaces from what is shown.

Re: splunk

vinod_52791 — Fri, 09 Oct 2020 11:45:48 GMT

i didnt understand what you are saying?

Re: splunk

ITWhisperer — Fri, 09 Oct 2020 12:49:02 GMT

When you paste your log entries, put them in a code sample by clicking on this symbolso we can see exactly what you have because the rex expression should have worked based on what you had pasted earlier.