How to write a Regular Expression to extract these values from my sample data into new fields?

namritha — Tue, 13 Sep 2016 14:10:16 GMT

Hi,
I have an application that calls other external applications/systems. I wish to plot the calls to external systems per server.
My log files look like this,

I have managed to extract a separate field, calls to external systems i.e. the value highlighted above. I need to further extract other values from this field. What I need is stated below,

Can you please tell me the rex command to be used?

NOTE: All values used in this question are dummy placeholders, and are not original configurations.

Thanks in advance.

Re: How to write a Regular Expression to extract these values from my sample data into new fields?

sundareshr — Tue, 13 Sep 2016 14:19:10 GMT

I don't think you can get all scenarios in one regex. You may be better off (reliability wise) creating separate regex. Something like this

... | rex field=fieldextractedfromraw "(?<addtional_info>http.*)\/" | rex field=fieldextractedfromraw "Client invoked\s(?<addtional_info>.*)"  | eval additonal_info=coalesce(additional_info, fieldextractedfromraw)

topic How to write a Regular Expression to extract these values from my sample data into new fields? in Splunk Search

How to write a Regular Expression to extract these values from my sample data into new fields?

Re: How to write a Regular Expression to extract these values from my sample data into new fields?