topic Re: How to extract data from log message data using rex field=_raw? Sample data is in Splunk Search

How to extract data from log message data using rex field=_raw? Sample data is

AK_Splunk — Mon, 26 Sep 2022 05:37:05 GMT

How to extract data from log message data using rex field=_raw? Sample data is

Instance Name : ABCDEFGH1
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=ampxwdp1o.pharma.aventis.com)(PORT=12345)))
Alias ABCDEFGH1
Uptime 4 days 6 hr. 39 min. 25 sec
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=113.09.126.234)(PORT=12345)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC12345)))
The command completed successfully
Instance Name : ABCDEFGH1TEMP
Instance Name : ABCDEFGQ1

I need to extract Instance name, Alias Uptime

Re: How to extract data from log message data using rex field=_raw? Sample data is

gcusello — Mon, 26 Sep 2022 06:42:01 GMT

Hi @AK_Splunk,

if you want to extract all the Instance Names present in your logs, you have to use two different regexes:

| rex "Instance\s+Name\s+:\s+(?<Instance_Name>\w+)" | rex "Uptime\s+(?<Uptime)>.+)"

that you can test athttps://regex101.com/r/vPWiOh/2 and https://regex101.com/r/vPWiOh/3

If instead you want to extract only the first Instance name, you can use

| rex "(?ms)Instance\s+Name\s+:\s+(?<Instance_Name>\w+).*Uptime\s+(?<Uptime>.+)Listening"

You can test this regex at https://regex101.com/r/vPWiOh/1

Anyway, you don't need to add field=_raw when you're searching on all the raw event.

Ciao.

Giuseppe

Re: How to extract data from log message data using rex field=_raw? Sample data is

AK_Splunk — Mon, 26 Sep 2022 06:57:49 GMT

Hi @gcusello
Thanks for your response means a lot.

| rex "(?ms)Instance\s+Name\s+:\s+(?<Instance_Name>\w+).*Uptime\s+(?<Uptime>.+)Listening"

using this regex help me extract the Instance_Name only in the correct format.
for uptime I am receiving output as below

4 days 6 hr. 39 min. 25 sec
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=113.09.126.234)(PORT=12345)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC12345)))
The command completed successfully
Instance Name : ABCDEFGH1TEMP
Instance Name : ABCDEFGQ1

I also have to extract the Alias name
I tried using | rex "Alias\s+(?<Alias)>.+)" for this I am getting below mentioned error.

Error in 'rex' command: Encountered the following error while compiling the regex 'Alias\s+(?<Alias)>.+)': Regex: syntax error in subpattern name (missing terminator).

Please assist me on the same.

Re: How to extract data from log message data using rex field=_raw? Sample data is

gcusello — Mon, 26 Sep 2022 07:12:50 GMT

Hi @AK_Splunk,

abou the output you're receiving, in regex101 it correctly runs, I don't know why you the this output instead teh correct one, maybe try to use this, but it should be the same thig:

| rex "(?ms)Instance\s+Name\s+:\s+(?<Instance_Name>\w+).*Uptime\s+(?<Uptime>.+)Listening Endpoints Summary"

About the alias, I don't see any alias word in your logs and there's a wrong parethesis in the field name:

"Alias\s+(?<Alias)>.+)"

Ciao.

Giuseppe

Re: How to extract data from log message data using rex field=_raw? Sample data is

AK_Splunk — Mon, 26 Sep 2022 07:22:14 GMT

hi @gcusello
Thanks for your response

The third line has alias feild

Re: How to extract data from log message data using rex field=_raw? Sample data is

gcusello — Mon, 26 Sep 2022 08:41:21 GMT

Hi @AK_Splunk,

sorry, I don't know how I did to not see it!

Anyway, please try this:

| rex "Alias\s+(?<Alias>\w+)"

Ciao.

Giuseppe