topic Re: Splunk Regex for Field Extraction in Splunk Search

Splunk Regex for Field Extraction

harish0557 — Mon, 14 Sep 2015 19:47:09 GMT

I want to extract fields from the below string(JSON) for:

eval time for each javascript (i.e require.min.js)
Load time for each javascript (i.e require.min.js)

Sample data:

"date":"2014-09-14T18:39:45.170Z","level":"INFO","logger":"marker.RESTART","seq":2,"msg":{"message":"load time in milliseconds","data":[{"moduleName":"node_modules/requirejs/require.min.js","startTimestamp":1442255975613,"fileSize":15330,"loadTime":752,"evalTime":27},{"moduleName":"buildjs/hnav.framework.js","startTimestamp":1442255975619,"fileSize":2443141,"loadTime":1737,"evalTime":2126},{"moduleName":"buildjs/hnav.index.js","startTimestamp":1442255975624,"fileSize":487047,"loadTime":950,"evalTime":456}],"packageType":"PROD"},"version":"0.5.10.12","clientIp":"192.168.1.10"}

Please help me with the regex for it

Re: Splunk Regex for Field Extraction

skoelpin — Mon, 14 Sep 2015 19:54:55 GMT

Here's some untested regex which will work. Make sure to check the non-matches and see if there's anything left out

(?P<LoadTime>(?=\"loadTime\"\:)\d{2,6})
(?P<evalTime>(?=\"evalTime\"\:)\d{2,6})

Re: Splunk Regex for Field Extraction

harish0557 — Mon, 14 Sep 2015 19:56:59 GMT

but i want it for specific modules like - require.min.js , framework.js, index.js

Re: Splunk Regex for Field Extraction

richgalloway — Mon, 14 Sep 2015 20:12:31 GMT

Try this. It will extract the modules and times into multi-value fields. It then combines the fields and breaks them into separate events.

...  | rex max_match=0 "\{\"moduleName\":\"(?P<module>[^\"]*).*?\"loadTime\":(?P<loadTime>\d+),\"evalTime\":(?P<evalTime>\d+)}" | eval fields = mvzip(mvzip(module,loadTime),evalTime) | mvexpand fields |...