Dear All,
I am a rookie in Splunk and need your help to extract a fields from the log,
Example:
2022-07-15 14:30:43 , Oracle WebLogic Server is fully supported on Kubernetes , xsjhjediodjde,"approvalCode":"YES","totalCash":"85000","passenger":"A",dgegrgrg4t3g4t3g4t3g4t,rgrfwefiuascjcusc,
In this log i would like to have a extract as Cash and display the value in a tabular form as Date|Passenger|Amount
Please suggest.
Hi @thangarun,
update after your message:
| rex "\"totalCash\":\"(?<totalCash>\d+)\",\"passenger\":\"(?<passenger>[^\"]+)"
that you can test at https://regex101.com/r/KmAhE5/2
Supponing that that date and time you have is also the event timestamp, you could run something like this:
index=your_index
| rex "\"totalCash\":\"(?<totalCash>\d+)\",\"passenger\":\"(?<passenger>[^\"]+)"
| table _time passenger totalCash
Ciao.
Giuseppe
Hi @thangarun,
as @ITWhisperer said, it isn't so clear what's the diferene (in your logs) between cash and amount.
Anyway, the regex to extract the totalCash is the following
| rex "\"totalCash\":\"(?<totalCash>\d+)"
that you can test at https://regex101.com/r/KmAhE5/1
Ciao.
Giuseppe
Hi @thangarun,
update after your message:
| rex "\"totalCash\":\"(?<totalCash>\d+)\",\"passenger\":\"(?<passenger>[^\"]+)"
that you can test at https://regex101.com/r/KmAhE5/2
Supponing that that date and time you have is also the event timestamp, you could run something like this:
index=your_index
| rex "\"totalCash\":\"(?<totalCash>\d+)\",\"passenger\":\"(?<passenger>[^\"]+)"
| table _time passenger totalCash
Ciao.
Giuseppe
Awesome....
You will need to be more specific
Assuming comma delimited, is the field you are interested in always the 5th field?
Does it always start with "totalCash"?
What would your expected output look like, e.g. does the Cash column always contain "totalCash"?
Do you already have some fields extracted when the events were ingested/indexed?
Hi @ITWhisperer Sorry for that. No its not the exact 5th field(above is just sample) and expected output is something like this(possible)
Date | Passenger | Cash |
15/7/2022 | A | 85000 |
Thanks a lot for very quick response.
Depending on your actual data (a single example doesn't really cut it unless it is 100% representative), you may need to deal with decimals
| rex "\"totalCash\":\"(?<totalCash>[\d\.]+)\",\"passenger\":\"(?<passenger>[^\"]+)"
Thanks a lot