topic Re: Need rex to extract field. in Splunk Search

How to create rex to extract field?

Harish2 — Thu, 12 Jan 2023 20:40:40 GMT

From here i need to extarct the identification=MLAS, MLA, LAS and VAM
My sample logs:
[12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid="7689-jhgg-8765r-kkjggt"; app=" "; QueryLetter="yard=MS&identification=MLAS&timeRange=EVERYDAY&timePeriod=MINUTES

[12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid="7689-jhgg-8765r-kkjggt"; app=" "; QueryLetter="yard=MS&identification=MLA&timeRange=EVERYDAY&timePeriod=MINUTES

[12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid="7689-jhgg-8765r-kkjggt"; app=" "; QueryLetter="yard=MS&identification=LAS&timeRange=EVERYDAY&timePeriod=MINUTES

[12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid="7689-jhgg-8765r-kkjggt"; app=" "; QueryLetter="yard=MS&identification=VAM&timeRange=EVERYDAY&timePeriod=MINUTES

in my selected fileds or intresting fileds indeentification fileds should appear has below:
MLAS
MLA
LAS
VAM

Re: Need rex to extract field.

richgalloway — Thu, 12 Jan 2023 20:19:27 GMT

The rex command works for me.

| rex "identification=(?<identification>\w+)"

Re: How to create rex to extract field?

yuanliu — Fri, 13 Jan 2023 08:31:48 GMT

Are posted logs raw events? Is there some settings in your sourcetype (props.conf) that prevents automatic extraction of the fields you wanted? Because the field names and values are connected by equal sign, Splunk should have already extracted them.

Here is an emulation of your samples:

| makeresults | fields - _time | eval data = split("[12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid=\"7689-jhgg-8765r-kkjggt\"; app=\" \"; QueryLetter=\"yard=MS&identification=MLAS&timeRange=EVERYDAY&timePeriod=MINUTES [12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid=\"7689-jhgg-8765r-kkjggt\"; app=\" \"; QueryLetter=\"yard=MS&identification=MLA&timeRange=EVERYDAY&timePeriod=MINUTES [12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid=\"7689-jhgg-8765r-kkjggt\"; app=\" \"; QueryLetter=\"yard=MS&identification=LAS&timeRange=EVERYDAY&timePeriod=MINUTES [12/12/21] 12:10:112 GMT] I6789HIOO applicattion authenticationid=100| |35467577889999| |67775-ghhgfrt-6788h-7667788; clientid=\"7689-jhgg-8765r-kkjggt\"; app=\" \"; QueryLetter=\"yard=MS&identification=VAM&timeRange=EVERYDAY&timePeriod=MINUTES", " ") | mvexpand data | rename data AS _raw | extract

These are the fields extracted:

QueryLetter	app	authenticationid	clientid	identification	timePeriod	timeRange
"yard=MS		100\| \|35467577889999\| \|67775-ghhgfrt-6788h-7667788	7689-jhgg-8765r-kkjggt	MLAS	MINUTES	EVERYDAY
"yard=MS		100\| \|35467577889999\| \|67775-ghhgfrt-6788h-7667788	7689-jhgg-8765r-kkjggt	MLA	MINUTES	EVERYDAY
"yard=MS		100\| \|35467577889999\| \|67775-ghhgfrt-6788h-7667788	7689-jhgg-8765r-kkjggt	LAS	MINUTES	EVERYDAY
"yard=MS		100\| \|35467577889999\| \|67775-ghhgfrt-6788h-7667788	7689-jhgg-8765r-kkjggt	VAM	MINUTES	EVERYDAY

Re: Need rex to extract field.

Harish2 — Wed, 18 Jan 2023 21:14:22 GMT

Hi @richgalloway
it worked, thank you