How to extract fields from HTML event?

bmanikya · ‎04-18-2023

Below is the sample HTML event

<HTML><BODY><TABLE border="1"><TH style=background-color:#00FFFF>Cluster</TH><TH style=background-color:#00FFFF>BlockSize</TH> <TR bgcolor=#ABEBC6><TD>GCS E1</TD><TD>41008</TD></TR><TR bgcolor=#ABEBC6><TD>VPay E1</TD><TD>18994</TD></TR><TR bgcolor=#ABEBC6><TD>Cadence E1</TD><TD>35345</TD></TR><TR bgcolor=#ABEBC6><TD>GCODS E1</TD><TD>3312</TD></TR><TR bgcolor=#ABEBC6><TD>EDMS E1</TD><TD>3715</TD></TR><TR bgcolor=#ABEBC6><TD>Nemo E1</TD><TD>3366332</TD></TR></TABLE></BODY></HTML>

Need a splunk query to extract above HTML event and output should be below.

Cluster	BlockSize
GCS E1	41008
VPay E1	18994
Cadence E1	35345
GCODS E1	3312
EDMS E1	3715
Nemo E1	3366332

@links

manjunathmeti · ‎04-18-2023

hi @bmanikya ,

Try this query:

| rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>" 
| eval zip=mvzip(Cluster, BlockSize) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)

Testing sample:

| makeresults 
| eval _raw="<HTML><BODY><TABLE border=\"1\"><TH style=background-color:#00FFFF>Cluster</TH><TH style=background-color:#00FFFF>BlockSize</TH> <TR bgcolor=#ABEBC6><TD>GCS E1</TD><TD>41008</TD></TR><TR bgcolor=#ABEBC6><TD>VPay E1</TD><TD>18994</TD></TR><TR bgcolor=#ABEBC6><TD>Cadence E1</TD><TD>35345</TD></TR><TR bgcolor=#ABEBC6><TD>GCODS E1</TD><TD>3312</TD></TR><TR bgcolor=#ABEBC6><TD>EDMS E1</TD><TD>3715</TD></TR><TR bgcolor=#ABEBC6><TD>Nemo E1</TD><TD>3366332</TD></TR></TABLE></BODY></HTML>" 
| rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>" 
| eval zip=mvzip(Cluster, BlockSize) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)

bmanikya · ‎09-14-2023

How to split the above table in one line each and wanted to have threshold if the current Block size exceeds Max Block size i.,e (85%) i want to trigger alert

ITWhisperer · ‎09-14-2023

| eval zip=mvzip(Cluster, Current, Max) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2)

bmanikya · ‎09-14-2023

It is not working since mvzip will process only X and Y fields. It worked with the below.

eval zip= mvzip(mvzip(Cluster,Current),Max)|mvexpand zip|eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1),Max=mvindex(zip, 2)

I am left with threshold, if the current is above 85% than Max, it should trigger an alert.

ITWhisperer · ‎09-14-2023

| eval zip=mvzip(Cluster, mvzip(Current, Max)) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2)
| eval threshold = Current / Max
| where threshold > 0.85

How to extract fields from HTML event?

splunk-assist

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?