topic Re: Extract fields using colon (:) except time field in Splunk Search

Extract fields using colon (:) except time field

richnavis — Tue, 29 Sep 2020 17:45:02 GMT

Hello,
I'm trying to use the field extraction tool for a data file that where the fields are delineated by a colon(:). However, the time fields ALSO contains a colon, so it doesn't extract this field correctly. Any thoughts on how to work around this? Sample Event Below

INFO : LM_36488 [Thu Jan 18 17:00:18 2018] : (11616|15356) Session task instance [Big_Data_Job] : [TM_6721 Started [Fetch Session from Repository].]

Predictably, this gets broken out like this
INFO
LM_36488 Thu Jan 18 17
00
18 2018 Session task instance [Big_Data_Job]
[TM_6721 Started [Fetch Session from Repository].]

Re: Extract fields using colon (:) except time field

horsefez — Fri, 19 Jan 2018 13:21:39 GMT

Hey richnavis,

when you do field extractions do "regular expressions" instead of "delimeters".
Then click "write your regular expression yourself" and paste this regex in:
(?<field1>[^\:]+)\s+?\:\s+?(?<field2>[^\[]+)\s+?\[(?<date>[^\]]+)\]\s+?\:\s+?(?<field4>[^\:]+)\s+?\:\s+?(?<field5>[^$]+)

substitute the "fieldX" values with the names your actual fields should have

Cheers!

https://regex101.com/r/ghD0XE/2

Re: Extract fields using colon (:) except time field

mayurr98 — Fri, 19 Jan 2018 13:44:41 GMT

hey try this run anywhere search

| makeresults | eval _raw="INFO : LM_36488 [Thu Jan 18 17:00:18 2018] : (11616|15356) Session task instance [Big_Data_Job] : [TM_6721 Started [Fetch Session from Repository].]" | rex field=_raw "^(?<field1>[^\:]+)\s:\s(?<field2>[^\]]+])\s:\s(?<field3>[^\]]+])\s:\s(?<field4>.*)"

In your environment you should write

<your_base_search> |rex field=_raw "^(?<field1>[^\:]+)\s:\s(?<field2>[^\]]+])\s:\s(?<field3>[^\]]+])\s:\s(?<field4>.*)"

let me know if this helps!

Re: Extract fields using colon (:) except time field

horsefez — Mon, 22 Jan 2018 14:45:38 GMT

@richnavis, any success with trying out the suggested solutions yet?