Getting Data In

How can i parse the value in this line

balash1979
Path Finder

I have the following line. I would like to parse the githash from it.

[08/Oct/2019:05:08:31 +0000]  200 \"GET / HTTP/1.1\" 1203 \"-\" ,"source":"stdout", "tag": test/test-ui:b1cd4er8590rj39d39309e9e9/test-ui/03e020671f70

When I run my splunk query, I want to display "b1cd4er8590rj39d39309e9e9".

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
try this regex

\"tag\":\s+[^:]*:(?<githash>[^\/]*)\/

you can use in a field extractor or in a rex command

| rex "\"tag\":\s+[^:]*:(?<githash>[^\/]*)\/"

You can test it at https://regex101.com/r/tCmHBh/1

Bye.
Giuseppe

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

| rex field=_raw "\"tag\":\s+[^:]+:(?<githash>[^/]+)/"

Use rex to extract a new field using a regular expression. This regex looks for "tag":, followed by some whitespace, followed by anything except a :, then :, then capture everything into a new field called "githash", up to the /

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...