How to extract the field from Logs

[aditsss]

Hi Everyone,

Can someone guide me how can I extract the below field highlighted in bold:

2021-05-04T05:01:03.702620566Z app_name=blazegqlgway-a environment=e2 ns=blazegateway pod_container=blazegqlgway-a pod_name=blazegqlgway-a-deployment-11-5sk6b stream=stdout message=2021-05-03 22:01:03.702 INFO [dgfgateway,264799cd7c73ee07,264799cd7c73ee07,true] 1 --- [nio-8443-exec-6] c.a.s.g.s.h.ResponseRetrieverService : nodeUrl=https://abc/graphql, caller=200005348C360VIEW, nodeHttpStatus=200, nodeResponseTime=1163

2021-05-03T21:44:45.4034061Z app_name=blazegqlgway-a environment=e2 ns=blazegateway pod_container=blazegqlgway-a pod_name=blazegqlgway-a-deployment-11-5sk6b stream=stdout message=2021-05-03 14:44:45.402 INFO [dgfgateway,daccee3618879e78,daccee3618879e78,true] 1 --- [nio-8443-exec-8] c.a.s.g.s.h.ResponseRetrieverService : nodeUrl=https://abc/graphql, caller=200000949GCPSfdcCommerical, nodeHttpStatus=200, nodeResponseTime=649

[aasabatini · Accepted solution]

Hi @aditsss 

try this on search to check my regular expression:

rex field=_raw "\[\w+,\w+,(?<name_field>\w+)"

if works properly add this field extraction on props.conf

https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/Propsconf

Alessandro