topic Re: How can I extract the fields from log file? in Splunk Search

How can I extract the fields from log file?

nayagan — Tue, 11 Oct 2022 15:13:18 GMT

I need to split the below log files to like excel table.

My Log file is:

2022-05-25 13:00:02 100.200.190.70 - test [12345]dele /TestingFile+-+END+-+GOD+WEL+SOONER+-+SFTP.txt - 220- 105 - 443
2022-06-30 12:05:08 200.231.150.150 - welcome [98765]created /TestingFileFromSource+-+COME+-+THE+END+Server+-+FileName.csv - 226 - 19 - 22

Expected Result is: ( I tried some regular expression but no luck)

Field1	Field2	Field3	Field4	Field5	Field6	Field7	Field8	Field9
2022/05/25 13:00:02	100.200.190.70	test	12345	dele	TestingFile END GOD WEL sooner SFTP.txt	220	105	443
2022/06/30 12:05:08	200.231.150.150	welcome	98765	created	TestingFileFromSource COME THE END Sending FileName.csv	226	19	22

Re: How can I extract the fields from log file?

gcusello — Tue, 11 Oct 2022 15:23:24 GMT

Hi @nayagan,

please try this regex

^(?<field1>\d+-\d+-\d+ \d+:\d+:\d+)\s+(?<field2>\d+\.\d+\.\d+\.\d+)\s+-\s+(?<field3>\w+)\s+\[(?<field4>\d+)\](?<field5>\w+)\s+\/(?<field6>.+)-\s+(?<field7>\d+)\s+-\s+(?<field8>\d+)\s+-\s+(?<field9>\d+)

that you can test at https://regex101.com/r/ozkFFe/1

Ciao.

Giuseppe

Re: How can I extract the fields from log file?

nayagan — Tue, 11 Oct 2022 15:44:12 GMT

Hi @gcusello - Thank you for your support, It is working fine now. How to remove "+-+" in the field6. I need only file as TestingFileFromSource COME THE END Server FileName.csv instead of TestingFileFromSource+-+COME+-+THE+END+Server+-+FileName.csv