How to extract fields from HTML event?

bmanikya · ‎04-18-2023

Below is the sample HTML event

<HTML><BODY><TABLE border="1"><TH style=background-color:#00FFFF>Cluster</TH><TH style=background-color:#00FFFF>BlockSize</TH> <TR bgcolor=#ABEBC6><TD>GCS E1</TD><TD>41008</TD></TR><TR bgcolor=#ABEBC6><TD>VPay E1</TD><TD>18994</TD></TR><TR bgcolor=#ABEBC6><TD>Cadence E1</TD><TD>35345</TD></TR><TR bgcolor=#ABEBC6><TD>GCODS E1</TD><TD>3312</TD></TR><TR bgcolor=#ABEBC6><TD>EDMS E1</TD><TD>3715</TD></TR><TR bgcolor=#ABEBC6><TD>Nemo E1</TD><TD>3366332</TD></TR></TABLE></BODY></HTML>

Need a splunk query to extract above HTML event and output should be below.

Cluster	BlockSize
GCS E1	41008
VPay E1	18994
Cadence E1	35345
GCODS E1	3312
EDMS E1	3715
Nemo E1	3366332

@links

manjunathmeti · ‎04-18-2023

hi @bmanikya ,

Try this query:

| rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>" 
| eval zip=mvzip(Cluster, BlockSize) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)

Testing sample:

| makeresults 
| eval _raw="<HTML><BODY><TABLE border=\"1\"><TH style=background-color:#00FFFF>Cluster</TH><TH style=background-color:#00FFFF>BlockSize</TH> <TR bgcolor=#ABEBC6><TD>GCS E1</TD><TD>41008</TD></TR><TR bgcolor=#ABEBC6><TD>VPay E1</TD><TD>18994</TD></TR><TR bgcolor=#ABEBC6><TD>Cadence E1</TD><TD>35345</TD></TR><TR bgcolor=#ABEBC6><TD>GCODS E1</TD><TD>3312</TD></TR><TR bgcolor=#ABEBC6><TD>EDMS E1</TD><TD>3715</TD></TR><TR bgcolor=#ABEBC6><TD>Nemo E1</TD><TD>3366332</TD></TR></TABLE></BODY></HTML>" 
| rex max_match=0 "\<TD\>(?<Cluster>[\w\s]+)\<\/TD\>\<TD\>(?<BlockSize>\d+)\<\/TD\>" 
| eval zip=mvzip(Cluster, BlockSize) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), BlockSize=mvindex(zip, 1)

bmanikya · ‎09-14-2023

How to split the above table in one line each and wanted to have threshold if the current Block size exceeds Max Block size i.,e (85%) i want to trigger alert

ITWhisperer · ‎09-14-2023

| eval zip=mvzip(Cluster, Current, Max) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2)

bmanikya · ‎09-14-2023

It is not working since mvzip will process only X and Y fields. It worked with the below.

eval zip= mvzip(mvzip(Cluster,Current),Max)|mvexpand zip|eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1),Max=mvindex(zip, 2)

I am left with threshold, if the current is above 85% than Max, it should trigger an alert.

ITWhisperer · ‎09-14-2023

| eval zip=mvzip(Cluster, mvzip(Current, Max)) 
| mvexpand zip 
| eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2)
| eval threshold = Current / Max
| where threshold > 0.85

How to extract fields from HTML event?

splunk-assist

See just what you’ve been missing | Observability tracks at Splunk University

Weezer at .conf25? Say it ain’t so!

How SC4S Makes Suricata Logs Ingestion Simple

Are you a member of the Splunk Community?

How to extract fields from HTML event?

splunk-assist

See just what you’ve been missing | Observability tracks at Splunk University

Weezer at .conf25? Say it ain’t so!

How SC4S Makes Suricata Logs Ingestion Simple