Splunk Enterprise

Log level extraction

sphiwee
Communicator

here is some sample data, can someone help me with a regular expression to extract the highlighted part "status:READY_TO_PROCESS" as process status

 

2020-10-18 14:06:18 [bp-[507bbd99]-completeMachineRun-233466] HitService [INFO] Created typed run Run: id=233467, uuid=7653767a-5e85-409d-aa3e-69bbeac40ad0 name=Final Results {size:0, status:READY_TO_PROCESS, rootRun:7653767a-5e85-409d-aa3e-69bbeac40ad0, data:}

Labels (1)
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

I expecting that there is always word status and then it’s value ending to ,. If this is not a valid expectation then this rex needs to updated.

 

...
| rex "(?<status>status:[^,]+)"

 

r. Ismo

View solution in original post

sphiwee
Communicator

Sorry but it's pulling something totally different

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Forget + from the end, did it works now?

isoutamo
SplunkTrust
SplunkTrust

Hi

I expecting that there is always word status and then it’s value ending to ,. If this is not a valid expectation then this rex needs to updated.

 

...
| rex "(?<status>status:[^,]+)"

 

r. Ismo

sphiwee
Communicator
Sorry but it's pulling something totally different
0 Karma

inventsekar
Super Champion

Hi @sphiwee ... @isoutamo 's rex query is working fine and extracting the status msg(did you add the plus sign and the field=_raw or ur fieldname?). Please check the screenshot:

| makeresults 
| eval log="2020-10-18 14:06:18 [bp-[507bbd99]-completeMachineRun-233466] HitService [INFO] Created typed run Run: id=233467, uuid=7653767a-5e85-409d-aa3e-69bbeac40ad0 name=Final Results {size:0, status:READY_TO_PROCESS, rootRun:7653767a-5e85-409d-aa3e-69bbeac40ad0, data:}" 
| rex field=log "(?<status>status:[^,]+)" | table status

 rex-status.jpg

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...