topic Re: extract a value from raw field in Splunk Search

extract a value from raw field

alexanderschlau — Tue, 12 Jan 2021 17:00:06 GMT

Hi ,

There is a way to extract a value from field even there is no = between Key and Value? After extracting I want to use them as a search criteria. Unfortunatelly I need to work with data which are not optimized for splunk.

For example : I have the following raw field:

"2020-12-16 13:39:00.7174 INFO 001d1764-80c3-4c35-87c7-ec25382b4328 IM_Contact with SetID Cardlink_DCDOB2012146196-1006 has current Status Completed. ContactID [CO-000085513778], CaseID [CA-000002980184] APOrchestrator.ProcessIncomingMessage => ServiceQueueOrchestrator`2.LogContactStatus => Logger.LogInfo"

I want to extract following key / values:

Info = 001d1764-80c3-4c35-87c7-ec25382b4328

SetID = Cardlink_DCDOB2012146196-1006

Status = Completed

ContactID = CO-000085513778

CaseID = CA-000002980184

Found some interesting answers but all of them working with real key value pairs (fields) as a basis.

Re: extract a value from raw field

richgalloway — Tue, 12 Jan 2021 20:46:53 GMT

That's easy to do with rex.

Re: extract a value from raw field

alexanderschlau — Wed, 13 Jan 2021 08:34:15 GMT

great, so simple and works, thank

Re: extract a value from raw field

alexanderschlau — Wed, 13 Jan 2021 08:39:39 GMT

I think there is a little change in CaseID and ContactID needed but I got the principle

Re: extract a value from raw field

richgalloway — Wed, 13 Jan 2021 13:51:17 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.