topic Re: Splunk multiple field extraction in Splunk Search

Splunk multiple field extraction

ppatkar — Fri, 19 Feb 2021 12:42:47 GMT

I have the below Splunk Event & need to extract multiple fields from the same :

[TIMESTAMP=2021-02-19 12:16:30.684 UTC] [RUN_ID=] [TRACE_ID=] [STEP=End Processing] [LINE_NO=701] [LOG_LEVEL=TRACE] [MESSAGE=[ppv] [insert] Query completed , total 11 ms: [10 values] INSERT INTO errors (job,run,timestamp,count,alert,error,code,message,completets,active) VALUES (?,?,?,?,?,?,?,?,?,?); [job:'endcustomer--prod', run:'4569876', timestamp:1613736990530, count:200, alert:'failed after launch', error:'', code:'E302: Batch failed', message:'', completets:'', active:false]]

Expected Table Output :

job	run	code
endcustomer--prod	4569876	E302: Batch failed

I was able to pick some field like :

run\:\'(?<run>\w+)'

https://regex101.com/r/q7NqQb/1

However, unable to extract all the three fields above. Any help is appreciated.

Re: Splunk multiple field extraction

manjunathmeti — Fri, 19 Feb 2021 12:54:15 GMT

hi @ppatkar,

Use rex command twice:

| rex "job:'(?<job>[^']+)',\srun:'(?<run>[^']+)" | rex "code:'(?<code>[^']+)'" | table job, run, code

If this reply helps you, an upvote/like would be appreciated.

Re: Splunk multiple field extraction

ppatkar — Wed, 24 Feb 2021 04:20:50 GMT

Hi @manjunathmeti

I have one followup to the earlier , in certain events I see truncated output like below :

[TIMESTAMP=2021-02-19 12:16:30.684 UTC] [RUN_ID=] [TRACE_ID=] [STEP=End Processing] [LINE_NO=701] [LOG_LEVEL=TRACE] [MESSAGE=[ppv] [insert] Query completed , total 11 ms: [10 values] INSERT INTO errors (job,run,timestamp,count,alert,error,code,message,completets,active) VALUES (?,?,?,?,?,?,?,?,?,?); [job:'endcustomer--pr..[truncated output], run:4569876, timestamp:1613736990530, count:200, alert:'failed after launch', error:'', code:'E302: Batch failed', message:'', completets:'', active:false]]

This is causing my job to get derived as null . Can you please advise ?

Re: Splunk multiple field extraction

manjunathmeti — Wed, 24 Feb 2021 04:46:06 GMT

Try this:

| rex "job:'?(?<job>[^']+)'?,\srun:'?(?<run>\d+)'?" | rex "code:'(?<code>[^']+)'" | table job, run, code

If this reply helps you, an upvote/like would be appreciated.

Re: Splunk multiple field extraction

jotne — Wed, 24 Feb 2021 09:16:26 GMT

All in on rex

Your search | rex "job:'(?<job>[^']+)'. run:'(?<run>[^']+)'.*? code:'(?<code>[^']+)'" | table job run code