topic Re: How to extract fields values including keywords in Splunk Search

How to extract fields values including keywords

Mr_Adate — Mon, 20 Feb 2023 08:42:48 GMT

I have three fields like "

field1=SGSIFASFFWR035A

field2=AXAZCBDM02

fields3=ESESDFAADFSABBM00002

in above examples I want to extract field values like these;

field1=FWR035A (any character after FW* including FW)

field2=BDM02 (any character after BDM* including BDM)

fields3=BBM00002 (any character after BBM* including BBM )

additionally, I want to to use single command to extract all three field values in one go.

like "FW*|BDM"|BBM*"

I am using below rex command to extract it but it is not including FW keyword in extracted field

| rex field= field1 "FW(?<AFTERTHISKEYWORD>\S+)"

if you can provide a workable solution either using rex and eval or another code, it would be appreciated.

Thanks in advance..

Re: How to extract fields values including keywords

gcusello — Mon, 20 Feb 2023 08:50:40 GMT

Hi @Mr_Adate,

could you share some sample of your logs to test the regex?

then, if you already have fields1, field2 and field3 and you want to take all the content, including prefix, whay do you need a regex?

Ciao.

Giuseppe

Re: How to extract fields values including keywords

ITWhisperer — Mon, 20 Feb 2023 08:59:35 GMT

rex can't be used to operate on more than one field at a time. However, you could operate on _raw, but in order to help you, you would need to share some examples of your raw events (not just the fields you have already extracted).

Re: How to extract fields values including keywords

Mr_Adate — Mon, 20 Feb 2023 09:26:40 GMT

I have uploaded .csv file

Firewall	Interface	Description
SGSIFASFFWR035A	port8	xafdy
AXAZCBDM02	port15.2	wawfesvcds
ESESDFAADFSABBM00002	port11	asdfasdf

I want to extract field values from Firewall field name

Re: How to extract fields values including keywords

Mr_Adate — Mon, 20 Feb 2023 09:28:24 GMT

I don't have _raw filed as I am uploading file from csv format

Re: How to extract fields values including keywords

gcusello — Mon, 20 Feb 2023 09:54:19 GMT

Hi @Mr_Adate,

have you in your props.conf the "INDEXED_EXTRACTIONS = csv" option ?

If yes, you should already have the data separated as fields.

Tiy can find many video that describe how to do it, e.g. https://www.youtube.com/watch?v=3kx0OGKy_XU

Ciao.

Giuseppe

Re: How to extract fields values including keywords

Mr_Adate — Mon, 20 Feb 2023 10:20:55 GMT

Thanks for your reply..

I have uploaded file as lookup not props.conf.