topic Field Extraction problem in Splunk Search

Field Extraction problem

bfernandez — Mon, 28 Sep 2020 10:05:10 GMT

I am trying to extract some data from a script output.
Sample:
SERVICE_NAME: WebTrends - Data Retention Service
DISPLAY_NAME: WebTrends - Data Retention Service
TYPE : 10 WIN32_OWN_PROCESS

STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
I have checked successfully the Generated pattern (regex) with the Interactive Field Extractor and also using a query.
index=main sourcetype="services_monitoring_status" | head 10000 | rex "(?i)SERVICE_NAME: (?P.+)"
But curiously if I save this regex as a Field extraction doesn’t work…because not only take the name. It takes all the rest of the event, not break at the end of the line.
Expected behavior:
Namefield = WebTrends - Data Retention Service
Incorrect behavior:
Namefield= WebTrends - Data Retention Service DISPLAY_NAME: WebTrends - Data Retention Service TYPE : 10 WIN32_OWN_PROCESS STATE : 1 STOPPED WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0
So How is possible this differents behavior doing the same?

Re: Field Extraction problem

hjwang — Fri, 11 Nov 2011 08:21:16 GMT

try this

rex "(?i)SERVICE_NAME:\s+(?P<fieldname>.+)([\r\n\s]+)"

Re: Field Extraction problem

bfernandez — Mon, 28 Sep 2020 10:05:31 GMT

This regex in a query works as well

index=main sourcetype="services_monitoring_status" | head 10000 | rex "(?i)SERVICE_NAME:\s+(?P.+)([\r\n\s]+)"

But If I save it as a field extraction in the console, it returns the same wrong values…as mine

(?i)SERVICE_NAME:\s+(?P.+)([\r\n\s]+)

Is strange that could returns different results depending on how you apply the regex.