topic Re: REX Field Help in Splunk Search

How to get fields extracted by two fields?

kc_prane — Sat, 12 Mar 2022 05:49:31 GMT

i need the fields extracted by two fields

1) Detail message = before the comma ( I need the full description)

2) Count = after the comma ( I need the digit count)

RAW Log starts from below :

DETAIL MESSAGE, COUNT Index 0 out of bounds for length 0, 61 No Recipienet found in MDM based on the input parameters, 120 No record found with this document Id, 86 No Records Found with given search Criteria in DB, 52 query did not return a unique result: 2; nested exception is javax.persistence.NonUniqueResultException: query did not return a unique result: 2, 106

You do not currently manage any user roles in PERLSS there is no task data to display at this time, 96

Re: REX Field Help

richgalloway — Fri, 11 Mar 2022 17:57:55 GMT

This should get you started

| rex "(?<detailMessage>[^,]+), (?<count>\d+)"

Re: REX Field Help

kc_prane — Fri, 11 Mar 2022 18:34:27 GMT

Thanks, @richgalloway. But here I am only getting the first line for the fields extracted in the log

Re: REX Field Help

richgalloway — Fri, 11 Mar 2022 19:50:39 GMT

You say you only get one line, but the screenshot shows 7 lines.

Please provide more information, including the query used and the props.conf settings for the sourcetype.

Re: REX Field Help

kc_prane — Fri, 11 Mar 2022 20:04:24 GMT

Hi @richgalloway I don't have much details of the props but the below screenshot shows the rex is working only for the first line.

Re: REX Field Help

richgalloway — Fri, 11 Mar 2022 20:23:24 GMT

It was not clear from the OP that the sample data was a single event rather than multiple events. That means the regular expression matches multiple strings, but the rex command defaults to returning only the first. Use the max_match option to override that.

| rex max_match=0 "(?<detailMessage>[^,]+), (?<count>\d+)"

This will produce multi-value fields. You'll then need to use mv commands/functions to work with the fields.

Let us know what results you want and we can try to be more specific.

Re: REX Field Help

kc_prane — Fri, 11 Mar 2022 20:21:48 GMT

Much appreciated mate for your help!. It worked for me.