Extraction skipping within the value

srinivas_gowda — Thu, 02 Dec 2021 08:31:49 GMT

Hello all,

I am trying to extract a field from the below event and the extraction is missing the last part of the field. Please help in getting this extracted.

Event:

117691777,00004105,00000000,5064,"20211202100006","20211202100006",4,-1,-1,"SYSTEM","","IPSC002",94882466,"MS932","Server-I ジョブ(Server:/IZ_SSYS_DB/DAILY/MP7/MP_D41/物流ルートテーブルデータ送信:@20H7984)を開始します(host: Host, JOBID: 229589)","Information","tdi01","/HITACHI/JP1/AJS2","JOB","AJSROOT1:/IZ_SSYS_DB/DAILY/MP7/MP_D41/物流ルートテーブルデータ送信","JOBNET","Server:/IZ_SSYS_DB/DAILY/MP7","Server:/IZ_SSYS_DB/DAILY/MP7/MP_D41/物流ルートテーブルデータ送信","START","20211202100006","","",16,"A0","Server:/IZ_SSYS_DB/DAILY","A1","MP7","A2","MP_D41/物流ルートテーブルデータ送信","A3","@20H7984","ACTION_VERSION","0600","B0","n","B1","2","B2","tdi01","B3","IPSC002","C0","IPSC202","C1","","C6","r","H2","188677","H3","pj","H4","q","PLATFORM","NT",

Extraction used:

(?:[^,]+,){14}(?<alert_description>[^,]+),

However the same extraction is working on the below event as expected.

117727680,00004103,00000000,5064,"20211202172828","20211202172828",4,-1,-1,"SYSTEM","","IPSC002",94918000,"MS932","Server-I ジョブネット(Server:/HTHACHU/IJH03/IJH03:@20I8438)が正常終了しました","Information","tdi01","/HITACHI/JP1/AJS2","JOBNET","AJSROOT1:/HTHACHU/IJH03/IJH03","JOBNET","AJSROOT1:/HTHACHU/IJH03/IJH03","AJSROOT1:/HTHACHU/IJH03/IJH03","END","20211202172827","20211202172828","",10,"A0","AJSROOT1:/HTHACHU/IJH03","A1","IJH03","A3","@20I8438","ACTION_VERSION","0600","B0","n","B1","0","B3","IPSC002","H2","853876","H3","n","PLATFORM","NT",

Please help extract the highlighted field.

Re: Extraction skipping within the value

ITWhisperer — Thu, 02 Dec 2021 08:42:06 GMT

Your alert has a comma in so try this

(?:[^,]+,){14}(?<alert_description>\"[^\"]*\"),

topic Re: Extraction skipping within the value in Splunk Search

Extraction skipping within the value

Re: Extraction skipping within the value