Getting Data In

Extract a string from an existing field value

avkchare
Loves-to-Learn

Hi guys,

I have the following event:

[DefaultMessageHistory[routeId=Receive, node=to618]], CamelToEndpoint=log://nl.vvv.kip.interfaces.timetellinboundtimecards.Receive?level=INFO&multiline=true&showAll=true&style=Fixed} Headers {breadcrumbId=ID-localhost-2206437765421-19-3, CamelFileAbsolute=true, CamelFileAbsolutePath=/data/bamba/Simebards
 
What I need is a regular expression to extract the word timetellinboundtimecards and I want to rename it service-name.
Furthermore, i need another regular expression to extract the word Receive (or Request or send or Failed)  and rename it to status.
 
Please let me know if you have the solution for this problem.
Kind regards,
K.C.
 
 
Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?

---
If this reply helps you, Karma would be appreciated.
0 Karma

avkchare
Loves-to-Learn

Hi Richgalloway,

To extract the word timetellinboundtimecards I used the following search query:

index=vip-ota Logger=nl.vvv.kip.interfaces.TimetellInboundTimecards.*
| rex "CamelToEndpoint=log:\/\/nl\.vvv\.kip\.interfaces\.(?<serviceName>.*)+\?level"
| table _time, serviceName

Kind Regards,

K.C.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your regex was close.  This one worked for me with your sample event.

CamelToEndpoint=log:\/\/nl\.vvv\.kip\.interfaces\.(?<serviceName>[^\.]+)\.(?<status>[^\?]+)\?

Are you familiar with the web site regex101.com for testing regular expressions? 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...