topic Field extraction for multiple types of values in Splunk Search

Field extraction for multiple types of values

srinivasgowda — Mon, 01 Mar 2021 07:12:19 GMT

Hello all,

I am trying to extract the data from the field evtComponent from the below event, and this has a multiple types of data that is coming in as below.

1) ZENOSS-MIB::evtComponent = STRING: "HostSystem_host-1240" ZENOSS-MIB::evtClass = STRING: "/Status/Ping"

2) ZENOSS-MIB::evtComponent = STRING: "\"London\"" ZENOSS-MIB::evtClass = STRING:

The highlighted fields needs to be extracted, however when I use the below extraction this only satisfies the correct extraction on example 1 but fails to just extract the field from example 2. Can you please suggest.

Below is the extraction that I am using.

ZENOSS-MIB::evtComponent = STRING: \"(?<component>.*)\"\s+ZENOSS-MIB::evtClass\s

Thank you.

Re: Field extraction for multiple types of values

gcusello — Mon, 01 Mar 2021 07:34:43 GMT

Hi @srinivasgowda,

you should try to use two regexes:

the first

| rex "evtComponent\s+\=\s+STRING:\s+\"(?<evtComponent>[^\"]+)\"\s+"

that you can test at https://regex101.com/r/Ip8Vj2/1

the second

| rex "evtComponent\s+\=\s+STRING:\s+\"\\\"(?<evtComponent>[^\\]+)"

that you can test at https://regex101.com/r/Ip8Vj2/2

Ciao.

Giuseppe

Re: Field extraction for multiple types of values

srinivasgowda — Fri, 05 Mar 2021 07:49:13 GMT

This worked. Thank you @gcusello