topic Re: How to maintain format into variables in Splunk Search

How to maintain format into variables

gerardo_maya — Mon, 28 Sep 2020 12:14:28 GMT

I want to extract part of an event that is multi-line and tab formated, the event lokks like this:

11:19:29.000 PM
7.05 0.00 (1343189969 083501): Query a ejecutar: SELECT prop_account, description
FROM tracking.google_analytics_web_properties
WHERE prop_type = 'qa'
AND home = 'es_cl'
AND portal = '*'

I want to extract from Query I use a regex and I have a variable called Message. But when I displayed it Splunk truncate the message.

1 Query a ejecutar: SELECT prop_account, description

I am using this search command:

sourcetype="xtype" query | rex field=_raw "):\s(?.+)" | table Message

Any idea could be great.

Re: How to maintain format into variables

lguinn2 — Fri, 10 Aug 2012 04:40:04 GMT

Try

sourcetype="xtype" query | rex field=_raw "(?m)):s(?<message>.+)" | table Message

The (?m) tells the regex to work across line breaks.

Re: How to maintain format into variables

gerardo_maya — Fri, 10 Aug 2012 15:23:07 GMT

Thank you, that works to capture all data into the variable but it does not maintain the line breaking inside the Message Variable

Re: How to maintain format into variables

gerardo_maya — Mon, 28 Sep 2020 12:14:40 GMT

Professional services recommend me to do the following:
sourcetype="xtype" query | eval long_str=replace(_raw, "\n", "###") | rex field=long_str "):\s(?.+)" | makemv delim="###" Message | table _time Message

The second part of the search replaces the new lines for a know pattern (on this case ###).
Then you use REGEX to capture the field from the long_str
Using makemv you break the lines when it found the pattern "###"
Lastly you present the data into a table, this is the result.

Query a ejecutar: SELECT prop_account, description FROM tracking.google_analytics_web_properties
WHERE prop_type = 'qa' AND
home = 'es_cl' AND portal = '*'