Splunk field extraction issue

manish007g — Mon, 26 Mar 2018 14:34:17 GMT

I want to extract a field event_id from the below log with all values being captured by this field name.

The Events to be distributed are [DefaultEvent: id=3348578, DefaultEvent: id=3704843, DefaultEvent: id=3861592, DefaultEvent: id=5818286, DefaultEvent: id=3913769, DefaultEvent: id=2656002, DefaultEvent: id=8864013, DefaultEvent: id=6864594, DefaultEvent: id=8160335, DefaultEvent: id=3919134, DefaultEvent: id=3675879, DefaultEvent: id=3658778, DefaultEvent: id=9414940, DefaultEvent: id=6878139, DefaultEvent: id=8798087, DefaultEvent: id=8678035]

Could some help me extract the field.

Re: Splunk field extraction issue

s2_splunk — Mon, 26 Mar 2018 18:43:18 GMT

Assuming your single event contains the data you show above verbatim, i.e.

The Events to be distributed are [DefaultEvent: id=3348578, DefaultEvent: id=3704843, DefaultEvent: id=3861592, DefaultEvent: id=5818286, DefaultEvent: id=3913769, DefaultEvent: id=2656002, DefaultEvent: id=8864013, DefaultEvent: id=6864594, DefaultEvent: id=8160335, DefaultEvent: id=3919134, DefaultEvent: id=3675879, DefaultEvent: id=3658778, DefaultEvent: id=9414940, DefaultEvent: id=6878139, DefaultEvent: id=8798087, DefaultEvent: id=8678035]

try this:

<yoursearch to find data> | rex max_match=0 "id=(?<event_id>\d+),"

This should give you a multi-value field called event_id which contains a list of all ids in the event. You can then do whatever you need to do with that.

topic Splunk field extraction issue in Splunk Search

Splunk field extraction issue

Re: Splunk field extraction issue