How to fetch file name from raw logs

[aditsss]

Hi Team,

2023-08-27 10:34:18.285 [INFO ] [Thread-30] TriumphUnbilledProcessor - TRIM.UNBILLED event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

2023-08-27 07:38:31.688 [INFO ] [Thread-31] TriumphCancelTransferProcessor - TRIM.CNX event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

I want to fetch filenames(bold) from row logs: TRIM.UNBILLED and TRIM.CNX

my current query:

index="abc"sourcetype =600000304_gg_abs_ipc1 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "event published to ebnc:" NOT "Utils -" | rex " event published to ebnc: \[\{\"status\":\"(?<status>.*)\",\"description\":\"(?<description>.*)\"\}\]" | eval message="event published to ebnc"
| table message status description

[gcusello]

Hi @aditsss,

please try the following regex:

! rex "Triumph.*Processor - (?<field>[^ ]*)"

that you can test at https://regex101.com/r/XNehPc/1

Ciao.

Giuseppe

[aditsss]

@gcusello 

It will not always 

"Triumph.*Processor

CarsUnbilledProcessor - CARS.UNBILLED event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

CarsDeltaHierarchyProcessor - CARS_HIERARCHY event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

2023-08-30 04:30:48.058 [INFO ] [Thread-43] TriumphProductProcessor - TRIM.PRD event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

Its both CARS and Triumph 

@gcusello can you provide me regex now.

[gcusello · Accepted solution]

Hi @aditsss,

is the processor word always present?

if yes, please try:

! rex "Processor - (?<field>[^ ]*)"

in other words, you have to find a rule to apply to the regex to identify the part to extract.

Ciao.

Giuseppe

[gcusello]

Hi @aditsss,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉