Dashboards & Visualizations

How to Extract the field from the raw logs


Hi Team,


Can  someone guide me how can I extract the logs from the below raw data:

1)Need to Extract the id 5d302144-3cab-387d-8e8c-2532a32b78fe

2) Need to Extract the Starting Time and the Stopping Time

2021-09-01 22:08:48,329 INFO [main] o.a.n.controller.StandardProcessorNode Starting SalesforceBulkAPIJobStatusProcessorV1[id=5d302144-3cab-387d-8e8c-2532a32b78fe]

2021-08-20 12:53:23,476 INFO [main] o.a.n.controller.StandardProcessorNode Stopping processor: SalesforceBatchJobStatusProcessor[id=11c59e11-4bc5-3bbb-9fea-3c12407f3aa2]


Can someone please guide me on this 

Labels (4)
0 Karma


Assuming you already have _time extracted(?)

| rex "(?<startstop>Starting|Stopping).*\[id=(?<id>[^\]]+)\]"
| eval startingtime=if(startstop="Starting",_time,null())
| eval stoppingtime=if(startstop="Stopping",_time,null())
| stats values(startingtime) as startingtime values(stoppingtime) as stoppingtime by id
0 Karma



I want Starting and Stopping time to extract separately. Also Id need to be extracted separately .

Can you provide me Regex for all three

0 Karma

| rex "\[id=(?<id>[^\]]+)\]"
| rex "(?<startingtime>^.+)\sINFO\s.*Starting"
| rex "(?<stoppingtime>^.+)\sINFO\s.*Stopping"

Path Finder

If the logs have all the same fields and only different values, i would use the Fieldextractor (found at splunks homescreen under "add data")

if not i would  try something like

index=YourIndex controller.StandardProcessorNode 
| rex "$.+ o\.a\.n\.controller\.StandardProcessorNode (?<Status>\w+) .+\[id\=(?<id>.+)\]$" 
| table _time Status id

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...