How to extract fields from HTML event?

bmanikya · ‎04-18-2023

Below is the sample HTML event

<HTML><BODY><TABLE border="1"><TH style=background-color:#00FFFF>Cluster</TH><TH style=background-color:#00FFFF>BlockSize</TH> <TR bgcolor=#ABEBC6><TD>GCS E1</TD><TD>41008</TD></TR><TR bgcolor=#ABEBC6><TD>VPay E1</TD><TD>18994</TD></TR><TR bgcolor=#ABEBC6><TD>Cadence E1</TD><TD>35345</TD></TR><TR bgcolor=#ABEBC6><TD>GCODS E1</TD><TD>3312</TD></TR><TR bgcolor=#ABEBC6><TD>EDMS E1</TD><TD>3715</TD></TR><TR bgcolor=#ABEBC6><TD>Nemo E1</TD><TD>3366332</TD></TR></TABLE></BODY></HTML>

Need a splunk query to extract above HTML event and output should be below.

Cluster	BlockSize
GCS E1	41008
VPay E1	18994
Cadence E1	35345
GCODS E1	3312
EDMS E1	3715
Nemo E1	3366332

@links

manjunathmeti · ‎04-18-2023

hi @bmanikya ,

Try this query:

| rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>" 
| eval zip=mvzip(Cluster, BlockSize) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)

Testing sample:

| makeresults 
| eval _raw="<HTML><BODY><TABLE border=\"1\"><TH style=background-color:#00FFFF>Cluster</TH><TH style=background-color:#00FFFF>BlockSize</TH> <TR bgcolor=#ABEBC6><TD>GCS E1</TD><TD>41008</TD></TR><TR bgcolor=#ABEBC6><TD>VPay E1</TD><TD>18994</TD></TR><TR bgcolor=#ABEBC6><TD>Cadence E1</TD><TD>35345</TD></TR><TR bgcolor=#ABEBC6><TD>GCODS E1</TD><TD>3312</TD></TR><TR bgcolor=#ABEBC6><TD>EDMS E1</TD><TD>3715</TD></TR><TR bgcolor=#ABEBC6><TD>Nemo E1</TD><TD>3366332</TD></TR></TABLE></BODY></HTML>" 
| rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>" 
| eval zip=mvzip(Cluster, BlockSize) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)

bmanikya · ‎09-14-2023

How to split the above table in one line each and wanted to have threshold if the current Block size exceeds Max Block size i.,e (85%) i want to trigger alert

ITWhisperer · ‎09-14-2023

| eval zip=mvzip(Cluster, Current, Max) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2)

bmanikya · ‎09-14-2023

It is not working since mvzip will process only X and Y fields. It worked with the below.

eval zip= mvzip(mvzip(Cluster,Current),Max)|mvexpand zip|eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1),Max=mvindex(zip, 2)

I am left with threshold, if the current is above 85% than Max, it should trigger an alert.

ITWhisperer · ‎09-14-2023

| eval zip=mvzip(Cluster, mvzip(Current, Max)) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2)
| eval threshold = Current / Max
| where threshold > 0.85

How to extract fields from HTML event?

splunk-assist

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Join the Conversation

How to extract fields from HTML event?

splunk-assist

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance