Solved: Help with Field Extraction from raw data

yuvasree · ‎08-01-2022

Below is the sample input for my search

BusinessIdentifier : 09 ***** MessageIdentifier : 3308b7dd-826c-4e98-8511-6a018c5f8bcc ***** TimeStamp : 2022-03-16T11:08:30.013Z ***** ElapsedTime : 0.25 ***** InterfaceName : NLTOnline ***** ServiceLayerName : OSB ***** ServiceLayerOperation : CreateQPBillingEvents ***** ServiceLayerPipeline : requestPipeline ***** SiteID : ***** DomainName : ***** ServerName : DEVserver ***** FusionErrorCode : ***** FusionErrorMessage : ***** <Body xmlns="http://schemas.xmlsoap.org/soap/envelope/"><com:createQPBillEvents xmlns:com="com.alcatel.lucent.on.ws.manager"> <com:ACTION_DATE>2021-08-30T23:59:59+08:00</com:ACTION_DATE> <com:ADR_BLDG_TYPE>HDB</com:ADR_BLDG_TYPE>

=============

I need to extract the values of the below

ElapsedTime : 0.25

InterfaceName : NLTOnline

ServiceLayerName : OSB

ServiceLayerOperation : CreateQPBillingEvents

ServiceLayerPipeline : requestPipeline

Using xmlkv its not working. can someone help to provide the right command?

richgalloway · ‎08-01-2022

xmlkv doesn't work because the event is not well-formed XML so it's rex to the rescue! 🙂

| rex "ElapsedTime : (?<ElapsedTime>\S+)"
| rex "InterfaceName : (?<InterfaceName>\S+)"
| rex "ServiceLayerName : (?<ServiceLayerName>\S+)"
| rex "ServiceLayerOperation : (?<ServiceLayerOperation>\S+)"
| rex "ServiceLayerPipeline : (?<ServiceLayerPipeline>\S+)"

If it weren't for the spaces around the colons, the extract command might have worked, but that's why we have rex.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎08-01-2022

xmlkv doesn't work because the event is not well-formed XML so it's rex to the rescue! 🙂

| rex "ElapsedTime : (?<ElapsedTime>\S+)"
| rex "InterfaceName : (?<InterfaceName>\S+)"
| rex "ServiceLayerName : (?<ServiceLayerName>\S+)"
| rex "ServiceLayerOperation : (?<ServiceLayerOperation>\S+)"
| rex "ServiceLayerPipeline : (?<ServiceLayerPipeline>\S+)"

If it weren't for the spaces around the colons, the extract command might have worked, but that's why we have rex.

---
If this reply helps you, Karma would be appreciated.

Help with Field Extraction from raw data

field extraction

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?