Splunk Cloud Platform

How to extract fields from raw event with rex?


Hello Splunkers, 


I wanted to extract  output1 and output6 fields from raw event

Example Event1:

Message : output,1: The guess/tmp/var/tms/bmp_abcd/apm_salesforce/address_standardplot/serviceinput/AddressStandardiplot_S3_VariousDmsJob_V9_apm_unmatch_AVI-pct-STANDARD_123456789_9912333333-f12f-5cb9-aa10-9d101188ad47.banana.2 file, which contains 456 rows, was written to the standardplot-s3-abc-dev-005 bucket.

Example Event 2

Message : output,6: Input 0 consumed 123 records.

desired result

output1=456 rows
output6=123 records

Message field is also not auto extracted by Splunk. May need to use |rex field=_raw........

Please Advise


Labels (1)
Tags (3)
0 Karma

| rex "output,1.*?(?<output1>\d+\s+rows)"
| rex "output,6.*?(?<output6>\d+\s+records)"
0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...