Dashboards & Visualizations

How to Extract the field from raw data

aditsss
Motivator

Hi Everyone,

Can someone guide me how to extract the filed from raw data.(The field highlighted in bold)

2021-05-03T20:34:46.574469127Z app_name=blazegqlgway-a environment=e2 ns=blazegateway pod_container=blazegqlgway-a pod_name=blazegqlgway-a-deployment-11-5sk6b stream=stdout message=2021-05-03 13:34:46.574 INFO [dgfgateway,c6e3e9be5ff5499a,c6e3e9be5ff5499a,true] 1 --- [nio-8443-exec-7] c.a.s.g.s.h.ResponseRetrieverService : nodeUrl=https://abc/graphql, caller=200000949GCPSfdcCommerical, nodeHttpStatus=200, nodeResponseTime=691

2021-05-03T10:04:33.485822671Z app_name=blazegqlgway-a environment=e2 ns=blazegateway pod_container=blazegqlgway-a pod_name=blazegqlgway-a-deployment-11-5sk6b stream=stdout message=2021-05-03 03:04:33.485 INFO [dgfgateway,68cdbc43702536b4,68cdbc43702536b4,true] 1 --- [nio-8443-exec-7] c.a.s.g.s.h.ResponseRetrieverService : nodeUrl=https://jkl/graphql, caller=200000949GCPSfdcCommerical, nodeHttpStatus=200, nodeResponseTime=615

Thanks in advance

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use rex

 

| rex field=_raw "message=(?<messageTime>\d+-\d+-\d+\s\d+:\d+:\d+\.\d+)"

but depending on how you have set up your ingestion, it's likely that Splunk is already finding the event time field from the timestamp of the event at the start of the raw data. Is that always the same. If so, you can use just _time.

 

 

View solution in original post

aasabatini
Motivator

Hi @aditsss 

in this case I suggest to use the extract key-value extraction

https://docs.splunk.com/Documentation/Splunk/8.1.3/Knowledge/Automatickey-valuefieldextractionsatsea...

most of your log is managed like this

key="value" key2="value"

in this case you can set this on your props.conf under the sourcetype stanza

KV_MODE = auto
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use rex

 

| rex field=_raw "message=(?<messageTime>\d+-\d+-\d+\s\d+:\d+:\d+\.\d+)"

but depending on how you have set up your ingestion, it's likely that Splunk is already finding the event time field from the timestamp of the event at the start of the raw data. Is that always the same. If so, you can use just _time.

 

 

Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...