Knowledge Management

How to extract field using rex command

philgopaul
New Member

Hi,

I have this sample log and I want to extract the request ID value after the period. Each of those numbers are unique in my log file.

Timeout sending message for request ID.140445678

I've tried various ways but cannot come up with working rex command that would extract those values as a field.

... | rex field=_raw "request <(?w+)>"

Any assistance would be awesome, thanks so much.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Try this:

... | rex "(?<request>\d+)[\r\n\s]*$"
0 Karma

vinod94
Contributor

You can try this,

| makeresults 
| eval data="Timeout sending message for request ID.140445678" 
| rename data as _raw 
| rex "request\sID\.(?P<request_id>.*)"
0 Karma

renjith_nair
Legend

@philgopaul ,

Try

|rex field=_raw "request ID\.(?<request_id>\d+)"
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...