All Apps and Add-ons

Extracting field below variable

aaronkorn
Splunk Employee
Splunk Employee

Hello, we are looking at errpt messages and are having difficulty extracting certain fields from the text below:

Everything with a ":" was easy to extract the value but we are having problems extracting the field below Description, which would be REPAIR ACTION in the first example. Any idea how to extract this file or a regex that would accomplish this?

Date/Time: Mon Jan 14 10:23:35 EST 2013
Sequence Number: 4287
Machine Id: 00F6BEB14C00
Node Id: h1dev16
Class: H
Type: INFO
WPAR: Global
Resource Name: fscsi2

Resource Class:

Resource Type:

Location:

Description
REPAIR ACTION
User Causes
PARTS REPLACEMENT

Date/Time: Wed Jan 9 17:49:04 EST 2013
Sequence Number: 4283
Machine Id: 00F6BEB14C00
Node Id: h1dev16
Class: O
Type: INFO
WPAR: Global
Resource Name: hdisk57

Description
PATH HAS RECOVERED
Probable Causes
ADAPTER HARDWARE OR CABLE
DASD DEVICE
Failure Causes
EF00

0 Karma

jkat54
SplunkTrust
SplunkTrust

Assuming thats a line break:

rex field="yourfield" "(?<desc>(?<=Description\r)(.*))" | table desc

http://gskinner.com/RegExr/ is a great tool for these scenarios

aaronkorn
Splunk Employee
Splunk Employee

This does not seem to work for us. If we were to copy that regex into the field extraction tool it cant seem to match (?(?<=Description\r)(.*))

0 Karma

jkat54
SplunkTrust
SplunkTrust

Since you didnt mention you would put this in the field extractor I told you how to do it with the rex command.,

To do it in field extractor, you could change it to (?<=Description\r)(.*)

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...