Extract Multiple Fields with Regex

ryoji_solsys — Mon, 28 Sep 2020 18:19:28 GMT

I would like to extract fields in the response field dynamically by using "<_KEY_1" "<_VAL_1>" in transforms.conf

response = "customer:{tel:123456} startpoint:{http://www.splunk.com} interfaceNumber:{1234} name:{abc}"

Ideally I want to generate fields as

response-customer-tel = 123456
response-startpoint = http://www.splunk.com
response-interfacenumber = 1234 
response-name = abc

I have the following regex.

response=.+ (?<_KEY_1>\w+)\:\{(?<_VAL_1>.+)\}

I only get the last field "name" = "abc" extracted.

What is the best way to extract multi-fields dynamically by using KEY and VAL. (I don't know how many entries the response field has since each event can have a different number of entries in the response field).
I would also like to extract fields in a way that append "response" to each field so that it says response-name, response-interfacenumber and so on...
I learned that I can use "FIELDALIAS" to modify the field names from the previous question but is there anyway I can append "request" to the extracted fields automatically ?

Thanks.

Re: Extract Multiple Fields with Regex

musskopf — Fri, 05 Dec 2014 02:25:35 GMT

Try to use this Regex:

(?P<_KEY_1>\w+):\{(?P<_VAL_1>[^\s]+)\}

I haven't tested in Splunk but tested in https://regex101.com/ and seems fine

Cheers

Re: Extract Multiple Fields with Regex

ryoji_solsys — Fri, 05 Dec 2014 03:01:39 GMT

Thanks for the prompt answer.
This helped me to extract multiple fields. But can I also somehow append "req" to each field automatically ?

topic Re: Extract Multiple Fields with Regex in Splunk Search

Extract Multiple Fields with Regex

Re: Extract Multiple Fields with Regex

Re: Extract Multiple Fields with Regex