topic field extraction in Splunk Search

field extraction

splunklearner — Wed, 05 Feb 2025 06:34:01 GMT

Hi,

Please extract DUSTER and JUNIPER as app_name from following sample events -

1. unit_hostname="GBWDC111AD011HMA.systems.uk.fed"

support_id="16675049156208762610"

vs_name="/f5-tenant-01/DUSTER-GBM-FR-DEV/v-dusteruat.systems.uk.fed-443"

policy_name="/Common/waf-fed-transparent"

2. unit_hostname="GBWDC111AD011HMA.systems.uk.fed"

support_id="16675049156208762610"

vs_name="/f5-tenant-01/JUNIPER-GBM-FR-DEV/v-juniperuat.systems.uk.fed-443"

policy_name="/Common/waf-fed-transparent"

The app_names will be dynamic and there is no gurantee that everytime GBM will not be coming beside app_names.

I tried this - vs_name=\"\/.*\/(?<app_name>.*)\-GBM

but as I told everytime GBM will not same in all events. Please make it generic and give the regex for me. Thanks

Re: field extraction

ITWhisperer — Wed, 05 Feb 2025 08:22:40 GMT

Regular expressions work on pattern matching and two examples is not many to secure a reliable pattern, that being said, if your data has already been extracted into the vs_name field, you could try something like this

| rex field=vs_name "^\/[^\/]+\/(?<app_name>\w+)\-"

Re: field extraction

kiran_panchavat — Wed, 05 Feb 2025 08:52:08 GMT

@splunklearner Please check this

| makeresults count=2 
| eval vs_name1="/f5-tenant-01/DUSTER-GBM-FR-DEV/v-dusteruat.systems.uk.fed-443"
| eval vs_name2="/f5-tenant-01/JUNIPER-GBM-FR-DEV/v-juniperuat.systems.uk.fed-443"
| eval vs_name=mvappend(vs_name1, vs_name2)
| mvexpand vs_name
| rex field=vs_name "\/[^\/]+\/(?<app_name>[^\/\-]+)"
| table vs_name, app_name