topic Re: Field Extraction in Splunk Search

Field Extraction

jeck11 — Wed, 10 Nov 2021 19:02:22 GMT

This has been asked a million times. I've been digging through the various postings but haven't figured out what I'm doing wrong.

I'm able to do a search time extraction using the rex command to get a field exactly the way I want it. But then when I try to add it to the field extractors, it's including too much information. I need to extract the LINK_TARGET value from the event below but the USER details are also being included in the field extractor setup.

Hopefully my redactions don't make this impossible for gurus to assist.

Search command:

index="index" search_term | rex field=_raw "LINK_TARGET\s:\s(?<link_target>.*)\n"

Data:

2021-11-10 16:03:14.631 INFO [blah] [Country=US] [User=user] [ip] [DefaultLynxMetricsLogger] [blah] [blah] Metrics logging start: key blah_SEARCH_ORIGIN LINK_TARGET : https://www.blah.com/en_US/blah?utm_source=copy&utm_medium=blah&utm_campaign=blah USER : 9999999 Metrics logging end

Re: Field Extraction

rafadvega — Wed, 10 Nov 2021 16:49:44 GMT

Hi!

You can use this command:

index="index" search_term | rex field=_raw "LINK_TARGET\s:\s(?<link_target>[^\n]*)\n"

Re: Field Extraction

ITWhisperer — Wed, 10 Nov 2021 16:56:10 GMT

Try this:

| rex field=_raw "LINK_TARGET\s:\s(?<link_target>\S*)"

Re: Field Extraction

jeck11 — Wed, 10 Nov 2021 17:54:37 GMT

The rex command is already working in the search time extraction. I'm trying to define it as a field extraction and that is where it's pulling back too much. Thanks though.

Re: Field Extraction

jeck11 — Wed, 10 Nov 2021 17:55:27 GMT

The search syntax that I included is working fine. I'm trying to define it as a field extraction and that's where it's pulling in too much. Thanks though.

Re: Field Extraction

ITWhisperer — Wed, 10 Nov 2021 18:48:48 GMT

What extraction do you currently have?

Re: Field Extraction

jeck11 — Wed, 10 Nov 2021 18:52:43 GMT

I just updated the original post with screenshot. Do they help clarify the issue?

Re: Field Extraction

ITWhisperer — Wed, 10 Nov 2021 18:57:29 GMT

So have you tried the different suggestions for the regex string?

Re: Field Extraction

jeck11 — Wed, 10 Nov 2021 19:01:34 GMT

I'm a moron. I just copied yours over and it worked. Thanks for sticking with me. I'll mark it as the answer.