topic Re: Field extraction in Splunk Search

Field extraction

Deepz2612 — Sat, 16 Dec 2017 16:10:11 GMT

Hi ,

For logs such as below please help me in extracting the data enclosed within double quotes.

Contact Dealership Name="Amery",Role= "IT_Deal"
Contact Dealership Name="US",Role= "IT_Deal"
Contact Dealership Name="J. Nuckolls, Inc. dba Fenton Auto Sales",Role= "IT_DEAN"

I tried using rex field=_raw "Contact Dealership Name=\"(?[^,]+)\""
But the results are as below :

Dealership_Name 
Amery
US

but J. Nuckolls, Inc. dba Fenton Auto Sales is not included in the result.
how the rex_field has to be modified to capture that also

Re: Field extraction

ifotopoulos — Sat, 16 Dec 2017 16:29:00 GMT

Try the following regex:

Contact Dealership Name=\"(.+?)\"

Re: Field extraction

mayurr98 — Sat, 16 Dec 2017 18:09:21 GMT

Hey @Deepz2612

Try this, you will be able to extract dealership name and role in one regex

| rex field=_raw “Contact\sDealership\sName=(\"|\s)(?P<ContactDealershipName>[^\"]+)\",Role=(\s|)\"(?P<Role>[^\"]+)”

Let me know if this works!

Re: Field extraction

niketn — Sat, 16 Dec 2017 18:38:50 GMT

@mayurr98, max_match=0 needs to be added in case this is a single event. Contact Dealership Name does not have space after equal to sign and before double quotes. However Role has a space before double quotes. So, the following regex should also work.

You have special character double quotes in the code above for regular expression convert to simple double quotes "

@Deepz2612, following is the run anywhere search based on your sample data:

| makeresults
| eval _raw="Contact Dealership Name=\"Amery\",Role= \"IT_Deal\"
 Contact Dealership Name=\"US\",Role= \"IT_Deal\"
 Contact Dealership Name=\"J. Nuckolls, Inc. dba Fenton Auto Sales\",Role= \"IT_DEAN\"
"
| rex "Contact\sDealership\sName=\"(?<contact_dealership_name>[^\"]+)\",Role=\s\"(?<role>[^\"]+)\"" max_match=0

Re: Field extraction

Deepz2612 — Sun, 17 Dec 2017 13:48:26 GMT

Great!
Thanks @niketnilay. this worked and thank you so much for helping me out.