How to extract a specific data from log?

[thangarun]

Dear All,

I am a rookie in Splunk and need your help to extract a fields from the log,

Example:

2022-07-15 14:30:43 , Oracle WebLogic Server is fully supported on Kubernetes , xsjhjediodjde,"approvalCode":"YES","totalCash":"85000","passenger":"A",dgegrgrg4t3g4t3g4t3g4t,rgrfwefiuascjcusc,

In this log i would like to have a extract as Cash and display the value in a tabular form as Date|Passenger|Amount 

Please suggest.

[gcusello]

Hi @thangarun,

as @ITWhisperer said, it isn't so clear what's the diferene (in your logs) between cash and amount.

Anyway, the regex to extract the totalCash is the following

| rex "\"totalCash\":\"(?<totalCash>\d+)"

that you can test at https://regex101.com/r/KmAhE5/1

Ciao.

Giuseppe

[gcusello · Accepted solution]

Hi @thangarun,

update after your message:

| rex "\"totalCash\":\"(?<totalCash>\d+)\",\"passenger\":\"(?<passenger>[^\"]+)"

that you can test at https://regex101.com/r/KmAhE5/2

Supponing that that date and time you have is also the event timestamp, you could run something like this:

index=your_index
| rex "\"totalCash\":\"(?<totalCash>\d+)\",\"passenger\":\"(?<passenger>[^\"]+)"
| table _time passenger totalCash 

Ciao.

Giuseppe

[thangarun]

Awesome....

[ITWhisperer]

You will need to be more specific

Assuming comma delimited, is the field you are interested in always the 5th field?

Does it always start with "totalCash"?

What would your expected output look like, e.g. does the Cash column always contain "totalCash"?

Do you already have some fields extracted when the events were ingested/indexed?

[thangarun]

 Hi @ITWhisperer  Sorry for that. No its not the exact 5th field(above is just sample) and expected output is something like this(possible)

Date	Passenger	Cash
15/7/2022	A	85000

Thanks a lot for very quick response.

[ITWhisperer]

Depending on your actual data (a single example doesn't really cut it unless it is 100% representative), you may need to deal with decimals

| rex "\"totalCash\":\"(?<totalCash>[\d\.]+)\",\"passenger\":\"(?<passenger>[^\"]+)"

[thangarun]

Thanks a lot