topic Re: Field extraction with complex events in Splunk Search

Help with field extraction with complex events

SplunkDash — Mon, 25 Jul 2022 14:59:11 GMT

Hello,

I have some issues with the field extraction for the following event (one sample event given below). Any recommendations will be highly appreciated. Thank you!

Sample Event

{

"time":"2022-07-01T10:44:16.230-05:10","@ver":"21","type":"track","DSTEST":"true","msg":"{\"timeStamp\":"2021-08-22T19:53:36.123+0000\",\"appName\":"wins\",\"userType\":"admin\",\"StatCd\":null,\"dollarAmt\":null,\"errorMsg\":null,\"eId\":"VIEW_BALANCE\",\"eventType\":"VIEW\",\"SourceCd\":"01\",\"ipAddr\":"127.0.0.13\",\"mftCd\":null,\"outputCd\":null,\"pNum\":null,\"rCd\":null,\"rtCd\":"03\",\"sId\":"48c42153-9cba2-42345-8faf-b57fb60fba6b\",\"tP\":null,\"empCode\":"234ass23\",\"empType\":"09\",\"uId\":"2350066750a0\",\"vd\":{}}"}

Re: Field extraction with complex events

richgalloway — Mon, 25 Jul 2022 00:07:53 GMT

What "issues" are you having? What have you tried so far? What were the results of those attempts? What results do you expect?

Re: Field extraction with complex events

SplunkDash — Mon, 25 Jul 2022 01:07:36 GMT

Hello,

Thank you so much for your quick response.

Objective is to extract Key Value pairs and

I was trying to use this code

time"\:"(?P<Time_Stamp>.+)","\@ver"\:"(?P<Ver>\d+)","type"\:"(?<Type>\w+)",

to extract each of the key value pairs. it not working as expected since some cases Key doesn't have corresponding Value...like following event doesn't have Value for type

{

"time":"2022-07-01T10:44:16.230-05:10","@ver":"21","type":"","DSTEST":"true","msg":"{\"timeStamp\":"2021-08-22T19:53:36.123+0000\",\"appName\":"wins\",\"userType\":"admin\",\"StatCd\":null,\"dollarAmt\":null,\"errorMsg\":null,\"eId\":"VIEW_BALANCE\",\"eventType\":"VIEW\",\"SourceCd\":"01\",\"ipAddr\":"127.0.0.13\",\"mftCd\":null,\"outputCd\":null,\"pNum\":null,\"rCd\":null,\"rtCd\":"03\",\"sId\":"48c42153-9cba2-42345-8faf-b57fb60fba6b\",\"tP\":null,\"empCode\":"234ass23\",\"empType\":"09\",\"uId\":"2350066750a0\",\"vd\":{}}"}

Re: Field extraction with complex events

richgalloway — Mon, 25 Jul 2022 15:07:47 GMT

All of the keys have values, but some of the values are empty. We can do that in a regex, but using * rather than + as the quantifier.

time":"(?P<Time_Stamp>.+)","@ver":"(?P<Ver>\d+)","type":"(?<Type>\w*)",