topic Re: How to extract multiple values for multiple fields from my sample multiline event using rex? in Splunk Search

How to extract multiple values for multiple fields from my sample multiline event using rex?

vijax — Sat, 03 Dec 2016 20:27:13 GMT

Below is my mentioned sample event details. I want to extract fields into a table using regex operations.

I need to only get IN and OUT status.

status  |  license  |  username  |  machine

IN      |  lic_1    |  user1     |  WKS1xxxx
OUT     |  lic_2    |  user2     |  WKS1xxxx
IN      |  lic_3    |  user3     |  WKS1xxxx

Sample data:

15:21:54 (app1) DENIED: "lic_1" user1@WKS1xxxx  (licenses are reserved for others. (-101,396:10054 ""))
15:21:54 (app1) DENIED: "lic_1" user1@WKS1xxxx  (User/host not on INCLUDE list for feature. (-39,349:10054 ""))
15:21:54 (app1) DENIED: "lic_1" user1@WKS1xxxx  (All licenses are reserved for others. (-101,396:10054 ""))
15:21:54 (app1) DENIED: "lic_1" user1@WKS1xxxx  (User/host not on INCLUDE list for feature. (-39,349:10054 ""))
15:21:54 (app1) DENIED: "lic_1" user1@WKS1xxxx  (All licenses are reserved for others. (-101,396:10054 ""))
15:21:54 (app1) DENIED: "lic_1" user1@WKS1xxxx  (User/host not on INCLUDE list for feature. (-39,349:10054 ""))
15:21:54 (app1) OUT: "lic_1" user1@WKS1xxxx  
15:21:54 (app1) UNSUPPORTED: "lic_2" (PORT_AT_HOST_PLUS   ) user1@WKS1xxxx  (License server system does not support this feature. (-18,327:10054 ""))
15:21:54 (app1) UNSUPPORTED: "lic_3" (PORT_AT_HOST_PLUS   ) user1@WKS1xxxx  (License server system does not support this feature. (-18,327:10054 ""))
15:21:54 (app1) UNSUPPORTED: "lic_2" (PORT_AT_HOST_PLUS   ) user1@WKS1xxxx  (License server system does not support this feature. (-18,327:10054 ""))
15:21:54 (app1) IN: "lic_3" user2@WKS2xxxx  
15:22:04 (app1) IN: "lic_1" user1@WKS1xxxx  
15:22:20 (app1) OUT: "lic_3" user3@WKS22xxx

Re: How to extract multiple values for multiple fields from my sample multiline event using rex?

Richfez — Sun, 04 Dec 2016 01:45:28 GMT

Try

 ... | rex "(?<status>(IN|OUT)):\s+"(?<license>[^"]*)"\s+(?<username>[^@]*)@(?<machine>.*)"

That should give you the fields you asked for on all lines that have the fields in them.

Link to regex101 sample

Re: How to extract multiple values for multiple fields from my sample multiline event using rex?

gokadroid — Sun, 04 Dec 2016 02:51:21 GMT

If each line is a single event above then @rich71777 's answer should hold good, however if more than one such lines exist per event then please give this a try:

your query to get the events
| rex max_match=0 field=_raw "(?<status>(IN|OUT)):\s*\"(?<license>[^\"]+)\"\s*(?<username>[^@]+)@(?<machine>[\S]+)"
| eval allValues=mvzip( status, mvzip(license, mvzip(username, machine, "~"), "~"), "~")
| mvexpand allValues
| rex field=allValues "(?<myStatus>[^~]+)~(?<myLicense>[^~]+)~(?<myUser>[^~]+)~(?<myMachine>.*)"
| table myStatus, myLicense, myUser, myMachine

Re: How to extract multiple values for multiple fields from my sample multiline event using rex?

chimell — Mon, 05 Dec 2016 11:22:59 GMT

In gokadroid answer, replace

(?<license>[^"]+)

with

 (?<license>[^\"]+)

to have a good answer. He forgot to escape " character

Re: How to extract multiple values for multiple fields from my sample multiline event using rex?

vijax — Thu, 08 Dec 2016 14:26:10 GMT

thanks all , gokadroid answer was great , and chimell pointed out the error. the final rex would include chimell changes

Re: How to extract multiple values for multiple fields from my sample multiline event using rex?

gokadroid — Thu, 08 Dec 2016 16:18:06 GMT

Thanks @chimell and @vijax ...nice catch! Updated as per comments. Up vote for both of you for refining the answer.