topic Re: Extracting through inconsistent data in Splunk Search

Extracting through inconsistent data

srinivas_gowda — Thu, 16 Sep 2021 07:14:32 GMT

Hello all,

Have been trying to extract the values through an inconsistent data as below. Highlighted values needs to be extracted, however the default extrcation through the tool is not working as expected. Could you please help in this.

50271234,00004105,00000000,1600,"20210901225500","20210901225500",4,-1,-1,"SYSTEM","","psd217",46769359,"MS932","KAVS0263-I \x83W\x83\x87\x83u(AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B:@5V689)\x82\xF0\x8AJ\x8En\x82\xB5\x82܂\xB7(host: UXC510, JOBID: 56620)","Information","jp1admin","/Example/JP1/AJS2","JOB","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B","JOBNET","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B","START","20210901225500","","",16,"A0","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds","A1","04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","A2","V9B01_B","A3","@5V0689","ACTION_VERSION","0600","B0","n","B1","1","B2","jp1admin","B3","psd217","C0","UXC510","C1","","C6","r","H2","677758","H3","j","H4","q","PLATFORM","NT",

50270531,00003A71,00000000,3588,"20210901224800","20210901224800",4,-1,-1,"SYSTEM","","PSC611",565029,"MS932","""SE_LOG: User - GetStringS: Failed to LookupAccountName. Domain (\\SERVER-retailing.group), Name (SERVER\QVADMIN). System Error""","Error","","/Example/JP1/NTEVENT_LOGTRAP/QlikViewServer","LOGFILE","NTEVENTLOG","LOGFILE","NTEVENTLOG","","","","","",9,"A0","1630504080","A1","PSC611.H2O-retailing.group","A2","Application","A3","Error","A4","None","A5","300","A6","N/A","PLATFORM","NT","PPNAME","/HITACHI/JP1/NTEVENT_LOGTRAP",

Highlighted fields are the ones I am trying to extract here.

Thank you

Re: Extracting through inconsistent data

richgalloway — Thu, 16 Sep 2021 12:02:55 GMT

It would help if you said how the tool (which tool?) is not living up to expectations.

Have you tried this regex?

(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}"(?<field2>[^"]+)","(?<field3>[^"]+)","(?<field4>[^"]+)","(?<field5>[^"]+)",".*?","(?<field6>[^"]+)

Re: Extracting through inconsistent data

srinivas_gowda — Fri, 17 Sep 2021 09:08:44 GMT

Hello,

I tried and I am getting the below error.

Error in 'SearchParser': Missing a search command before '^'. Error at position '92' of search query 'search index=*jp1* | rex field=_raw "(?:[^,]+,){3}...{snipped} {errorcontext = ?<field2>[^"]+)","(?<}'.

And when I use escape before the " like below

| rex field=_raw "(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}\"(?<field2>[^"]+)\",\"(?<field3>[^"]+)\",\"(?<field4>[^"]+)\",\"(?<field5>[^"]+)\",\".*?\",\"(?<field6>[^"]+)"

Still the below error.

Error in 'SearchParser': Mismatched ']'.

Thank you.

Re: Extracting through inconsistent data

richgalloway — Fri, 17 Sep 2021 15:39:50 GMT

Quotation marks embedded in the rex command must be escaped with three backslashes.