topic Re: Field Extraction-- Grab 3 digits between fixed words in Splunk Search

Field Extraction-- Grab 3 digits between fixed words

skoelpin — Wed, 20 May 2015 19:28:28 GMT

I have 3 different status codes which I need extracted, the words around them will be fixed and never change

I will have 3 different status codes (200, 400, 0)

So far I have

^StatusCode>(?P<StatusCode>\d{1,3})

It will always look like this

<a:StatusCode>200</a:StatusCode>
<a:StatusCode>400</a:StatusCode>
<a:StatusCode>0</a:StatusCode>

Re: Field Extraction-- Grab 3 digits between fixed words

pradeepkumarg — Wed, 20 May 2015 19:39:56 GMT

rex "(?i)StatusCode\W(?P<StatusCode>.\d+)\W"

Re: Field Extraction-- Grab 3 digits between fixed words

regexcracker — Wed, 20 May 2015 19:40:35 GMT

If the logger is in xml format then use

mysearch | xmlkv | search StatusCode | table StatusCode

if its a normal logger,

mysearch | rex field=_raw "(?<code>\d+)" | table StatusCode

OR try

mysearch | rex field=_raw "(?<code>\d+)" | table StatusCode

Re: Field Extraction-- Grab 3 digits between fixed words

skoelpin — Wed, 20 May 2015 20:12:04 GMT

Thanks for the reply. I need to extract a field so my team can use it at anytime. Any suggestions on the regex for extracting the field?

Re: Field Extraction-- Grab 3 digits between fixed words

skoelpin — Wed, 20 May 2015 20:15:11 GMT

Thanks for the reply. Nothing appeared when I put this in

index=uvtrans ...| rex "(?i)StatusCode\W(?P<StatusCode>.\d+)\W"

Re: Field Extraction-- Grab 3 digits between fixed words

jacobwilkins — Wed, 20 May 2015 20:25:57 GMT

In props.conf, under the stanza for this sourcetype (lets pretend it is called foo):

[foo]
EXTRACT-statuscode=^<a:StatusCode>(?<StatusCode>\d*)</a:StatusCode>$

That should do it. You might have to strip the anchors (either ^ or $) if the event doesn't always appear on a line by itself with no leading whitespace.

The the event is 100% XML, you might try this instead:

[foo]
KV_MODE=xml

Re: Field Extraction-- Grab 3 digits between fixed words

stephanefotso — Wed, 20 May 2015 22:00:45 GMT

here you go: ..|rex field=_raw "\<a\:StatusCode\>(?<statuscode>\d+)\<"|table statuscode

Re: Field Extraction-- Grab 3 digits between fixed words

skoelpin — Thu, 21 May 2015 01:17:18 GMT

This worked perfectly! I didn't know you could extract in props.conf, that's good to know

Can you elaborate on KV_MODE=xml?

Thanks for your help!!

Re: Field Extraction-- Grab 3 digits between fixed words

MuS — Thu, 21 May 2015 01:22:13 GMT

from the docs on props.conf http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Propsconf

Specifies the field/value extraction mode for the data.
* Set KV_MODE to one of the following:
    * xml : automatically extracts fields from XML data.