Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to extract the field from Logs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Everyone,
Can someone guide me how can I extract the below field highlighted in bold:
2021-05-04T05:01:03.702620566Z app_name=blazegqlgway-a environment=e2 ns=blazegateway pod_container=blazegqlgway-a pod_name=blazegqlgway-a-deployment-11-5sk6b stream=stdout message=2021-05-03 22:01:03.702 INFO [dgfgateway,264799cd7c73ee07,264799cd7c73ee07,true] 1 --- [nio-8443-exec-6] c.a.s.g.s.h.ResponseRetrieverService : nodeUrl=https://abc/graphql, caller=200005348C360VIEW, nodeHttpStatus=200, nodeResponseTime=1163
2021-05-03T21:44:45.4034061Z app_name=blazegqlgway-a environment=e2 ns=blazegateway pod_container=blazegqlgway-a pod_name=blazegqlgway-a-deployment-11-5sk6b stream=stdout message=2021-05-03 14:44:45.402 INFO [dgfgateway,daccee3618879e78,daccee3618879e78,true] 1 --- [nio-8443-exec-8] c.a.s.g.s.h.ResponseRetrieverService : nodeUrl=https://abc/graphql, caller=200000949GCPSfdcCommerical, nodeHttpStatus=200, nodeResponseTime=649
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @aditsss
try this on search to check my regular expression:
rex field=_raw "\[\w+,\w+,(?<name_field>\w+)"if works properly add this field extraction on props.conf
https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/Propsconf
Alessandro
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @aditsss
try this on search to check my regular expression:
rex field=_raw "\[\w+,\w+,(?<name_field>\w+)"if works properly add this field extraction on props.conf
https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/Propsconf
Alessandro
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
