topic Extract field in Splunk Search

Extract field

Sekhar — Wed, 04 Oct 2023 04:14:19 GMT

Log like.

message: [22/09/23 10:31:47:935 GMT] [ThreadPoolExecutor-thread-15759] INFO failed.", suspenseAccountNumber="941548131", suspenseAccountBSB="083021", timeCreate

as OTHER BUSINESS REASON returned by

CBIS.", debtor RoutingType="BBAN", debtor Routing Id="013013", creditor RoutingType="BBA

6899-422f-8162-6911da94e619", transactionTraceIdentification-1311b8a21-6d6c-422b-8

22T10:31:42.8152_00306", instrId="null", interactionId="null", interactionOriginators tx_uid-ANZBAU3L_A_TST01_ClrSttlmve01_2023-09-22T10:31:42.8152 00306, txId-ANZBAU3L priority-NORM, addressingType=noAlias, flow-N5XSuspense.receive]

How extract the transactionTraceIdentification filed

I tried already rex field= message "transactionTraceIdentification=\"(?<transactionTraceIdentification>.*?)\","

Not extraxted the vaule

Re: Extract field

yeahnah — Wed, 04 Oct 2023 04:23:07 GMT

Hi @Sekhar

try this..

| rex field=message "transactionTraceIdentification-(?<transactionTraceIdentification>[^\"]+)"

hope that helps

Re: Extract field

inventsekar — Wed, 04 Oct 2023 04:29:37 GMT

Hi @Sekhar ... pls provide some more log lines..

pls check this rex..

Splunk newbie learning videos, for absolute beginners:
https://www.youtube.com/@SiemNewbies101/playlists

i have added 24 small videos of rex... completely for splunk newbies and beginners.

source="rex.txt" host="laptop" sourcetype="rextest" | rex field=_raw "transactionTraceIdentification\-(?<transactionTraceIdentification>.*)" | table _raw transactionTraceIdentification

Re: Extract field

Sekhar — Wed, 04 Oct 2023 04:30:21 GMT

I tried getting empty

Re: Extract field

inventsekar — Wed, 04 Oct 2023 04:33:32 GMT

Hi @Sekhar your one line reply will not help us to help you.. pls write your full search query..

provide some more sample log lines..

Re: Extract field

yeahnah — Wed, 04 Oct 2023 04:33:47 GMT

Likely message is not an extracted field then.

Try this to extract from the _raw event

| rex field=_raw "transactionTraceIdentification-(?<transactionTraceIdentification>[^\"]+)