topic Re: How to extract these fields from my sample data? in Splunk Search

How to extract these fields from my sample data?

mcvr — Mon, 27 Jul 2015 11:35:19 GMT

I wanted to extract the below values.

Time Taken
Response code in the string - HTTP/1.1" 200 example, I need to know what the response code is, whether 200/404/500

Sample data:

 Time Taken: 937534 URL_STRING: /account/signin.jsp 95.104.163.4 - - [27/Jul/2015:02:10:34 -0700] "GET /account/signin.jsp?PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374304776473&bmUID=kX4Nj97 HTTP/1.1" 200 Bytes: 97413 "http://www.xxx.com/shop/dept_category.jsp?productSizeSelected=0&pageClicked=0&PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374306291898&bmUID=kX4NaK4" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 YaBrowser/15.6.2311.5029 Safari/537.36"

Re: How to extract these fields from my sample data?

krishnarajapant — Mon, 27 Jul 2015 13:23:29 GMT

Hi,

timetaken------- rex "Time Taken:(?\d*)"
status---------- rex "HTTP/\d.\d\"(?\d*)"

you can try with erex command and can get the proper regular expression from job or you can use the knowlede object "field extraction" so that you can get the base regular expression.

Above regular expression required little bit tweaking and testing.

-Krishan Rajapantula.

Re: How to extract these fields from my sample data?

somesoni2 — Mon, 27 Jul 2015 20:31:13 GMT

See if this works (run anywhere sample based on your data)

| gentimes start=-1 | eval temp="Time Taken: 937534 URL_STRING: /account/signin.jsp 95.104.163.4 - - [27/Jul/2015:02:10:34 -0700] \"GET /account/signin.jsp?PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374304776473&bmUID=kX4Nj97 HTTP/1.1\" 200 Bytes: 97413 \"http://www.xxx.com/shop/dept_category.jsp?productSizeSelected=0&pageClicked=0&PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374306291898&bmUID=kX4NaK4\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 YaBrowser/15.6.2311.5029 Safari/537.36\"" | table temp | rename temp as _raw | rex "Time Taken: (?<TimeTaken>\d+)([^\"]+)\"([^\"]+)\" (?<ResponseCode>\d+)"