topic Re: How to get 2 values out of a string using rex command in Splunk Search

How to get 2 values out of a string using rex command

rilee — Wed, 30 Jun 2021 14:51:25 GMT

I have the following sample data returned that I'd like to extract 2 fields out of it: 1) The value after the "T " and before the "EmployeeController.Post -" will be the first field <tsid>. 2) Between the "EmployeeController.Post - " and " - End" will be the second field <duration>.

06/30/21 09:39:21.39 p17872 [00226] T ELBJsZX6wk68nXrUKKEd4g EmployeeController.Post - 00:00:00:538 - End

Your help is highly appreciated.

Re: How to get 2 values out of a string using rex command

richgalloway — Wed, 30 Jun 2021 18:05:39 GMT

This is very straightforward so I'm interested in seeing what you've tried and help determine why it didn't work.

At search time, this can be done with two separate regexes:

| rex "] T (?<tsid>\S+)" | rex "EmployeeController.Post - (?<duration>\S+)"

or with a single regex:

| rex "] T (?<tsid>\S+) EmployeeController.Post - (?<duration>\S+)"

At index-time, use the latter regex.

Re: How to get 2 values out of a string using rex command

rilee — Wed, 30 Jun 2021 18:18:43 GMT

In my base index search, I added "EmployeeController.Post" "- End" filter values to return only the lines I need.

Then I used

| rex field=_raw "\s+T+\s(?<txid>.*?)\s+EmployeeController\\.Post\s\\-\s(?<duration>.*?)\s\\-\s+End"

|table txid duration

That did work and I have solved my issue just an hour ago!

But yours looks much neater. Thank you so much for your reply. I appreciate it. Practice makes perfection and I shall get better sooner than later.

Re: How to get 2 values out of a string using rex command

rilee — Wed, 30 Jun 2021 18:20:37 GMT

Sorry, tsid and txid are the same I am referring to. ^_^ I will refine my syntax to use your line. Thanks again