topic Re: How to Extract Values from a KV within a event log in Splunk Search

How to Extract Values from a KV within a event log

vickyvishwa — Thu, 24 Jan 2019 13:14:26 GMT

I have the below log event.

[INFO ] 2019-01-24T04:09:20,513 [thread=framework1234] className=DummyConsumer - {} - {topic=events-1, timestamp=12233344433, timestampType=CREATE_TIME, value={msg_id=bdb95851-1fd0-11e9-a1b3-yhgt6465783gh, ip=127.0.0.1, timestamp=2019-01-24 04:08:50.0}, logMessage=Event Processed, failure=F}

I have to extract timestamp and ip both of them inside value key. What is the best way to do that. I tried multiple extract commands nothing works (or probably I am doing wrong).

Re: How to Extract Values from a KV within a event log

harsmarvania57 — Thu, 24 Jan 2019 13:48:31 GMT

Hi,

Please try below regex, this will extract values in two fields timestamp and ip

<yourBasesearch> | rex field=_raw "ip=(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\,\stimestamp=(?<timestamp>[^}]*)"

Re: How to Extract Values from a KV within a event log

vnravikumar — Thu, 24 Jan 2019 13:50:38 GMT

Hi @vickyvishwa

Please Try

| makeresults 
| eval log=" [INFO ] 2019-01-24T04:09:20,513 [thread=framework1234] className=DummyConsumer - {} - {topic=events-1, timestamp=12233344433, timestampType=CREATE_TIME, value={msg_id=bdb95851-1fd0-11e9-a1b3-yhgt6465783gh, ip=127.0.0.1, timestamp=2019-01-24 04:08:50.0}, logMessage=Event Processed, failure=F}" 
| rex field=log "ip=(?P<ip>.*),\stimestamp=(?P<timestamp>.*)}," 
| table ip,timestamp