Getting Data In

Extract a string from an existing field value

avkchare
Loves-to-Learn

Hi guys,

I have the following event:

[DefaultMessageHistory[routeId=Receive, node=to618]], CamelToEndpoint=log://nl.vvv.kip.interfaces.timetellinboundtimecards.Receive?level=INFO&multiline=true&showAll=true&style=Fixed} Headers {breadcrumbId=ID-localhost-2206437765421-19-3, CamelFileAbsolute=true, CamelFileAbsolutePath=/data/bamba/Simebards
 
What I need is a regular expression to extract the word timetellinboundtimecards and I want to rename it service-name.
Furthermore, i need another regular expression to extract the word Receive (or Request or send or Failed)  and rename it to status.
 
Please let me know if you have the solution for this problem.
Kind regards,
K.C.
 
 
Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?

---
If this reply helps you, Karma would be appreciated.
0 Karma

avkchare
Loves-to-Learn

Hi Richgalloway,

To extract the word timetellinboundtimecards I used the following search query:

index=vip-ota Logger=nl.vvv.kip.interfaces.TimetellInboundTimecards.*
| rex "CamelToEndpoint=log:\/\/nl\.vvv\.kip\.interfaces\.(?<serviceName>.*)+\?level"
| table _time, serviceName

Kind Regards,

K.C.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your regex was close.  This one worked for me with your sample event.

CamelToEndpoint=log:\/\/nl\.vvv\.kip\.interfaces\.(?<serviceName>[^\.]+)\.(?<status>[^\?]+)\?

Are you familiar with the web site regex101.com for testing regular expressions? 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...