topic Re: Regex Expressions in Splunk Search

Regex Expressions

anandhalagarasa — Thu, 11 Oct 2018 12:55:32 GMT

Hi Team,

I need to extract the fields from the JSON format in my Search Head GUI so kindly let us know how to proceed further.

{ [-]
id:

message: 2018-10-11 10:33:46,879 [44] |INFO|Access=abcdef|Max=(abcd)|Data=(xyz)|Fox=(ghi)|Mach=(pqrs)|Bend=(uvw)| http://amazon.com.local:098765/dam/healthchecks/band

 severity:   INFO

}

Need to extract fields in the form of Regex:

Date:2018-10-11 10:33:46,879
Level=INFO
Access=abcdef
Max=(abcd)
Fox=(ghi)
Mach=(pqrs)
Bend=(uvw)
Message=http://amazon.com.local:098765/dam/healthchecks/band

Once the fields are extracted if we click Max on the left hand side it needs to show abcd

So kindly help on this to make up a regex so that i can able to implement the same and extract those fields.

Re: Regex Expressions

anandhalagarasa — Thu, 11 Oct 2018 13:12:33 GMT

Kindly help on this request.

Re: Regex Expressions

kmorris_splunk — Thu, 11 Oct 2018 13:16:03 GMT

Could you re-paste your sample? It seems like you may have formatted part of it as code using the 101010 button.

Re: Regex Expressions

inventsekar — Thu, 11 Oct 2018 13:16:30 GMT

you want to extract the fields from the logs which are already ingested or you want to setup props/transforms, so that the future logs will be automatically extracted?!?!

Re: Regex Expressions

anandhalagarasa — Thu, 11 Oct 2018 13:21:43 GMT

I want to extract the fields which is already getting ingested into Splunk and they are in JSON format. And I want to extract in GUI using Regex expressions.

Re: Regex Expressions

anandhalagarasa — Thu, 11 Oct 2018 13:41:20 GMT

Kindly help

Re: Regex Expressions

skoelpin — Thu, 11 Oct 2018 14:57:44 GMT

If its already in Splunk and you want to extract at search-time, you will then need to get crafty with spath

https://answers.splunk.com/answers/642304/how-can-i-extract-the-json-data-as-key-value-pair.html