Splunk Enterprise

Log level extraction

sphiwee
Contributor

here is some sample data, can someone help me with a regular expression to extract the highlighted part "status:READY_TO_PROCESS" as process status

 

2020-10-18 14:06:18 [bp-[507bbd99]-completeMachineRun-233466] HitService [INFO] Created typed run Run: id=233467, uuid=7653767a-5e85-409d-aa3e-69bbeac40ad0 name=Final Results {size:0, status:READY_TO_PROCESS, rootRun:7653767a-5e85-409d-aa3e-69bbeac40ad0, data:}

Labels (1)
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

I expecting that there is always word status and then it’s value ending to ,. If this is not a valid expectation then this rex needs to updated.

 

...
| rex "(?<status>status:[^,]+)"

 

r. Ismo

View solution in original post

sphiwee
Contributor

Sorry but it's pulling something totally different

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Forget + from the end, did it works now?

isoutamo
SplunkTrust
SplunkTrust

Hi

I expecting that there is always word status and then it’s value ending to ,. If this is not a valid expectation then this rex needs to updated.

 

...
| rex "(?<status>status:[^,]+)"

 

r. Ismo

sphiwee
Contributor
Sorry but it's pulling something totally different
0 Karma

inventsekar
Ultra Champion

Hi @sphiwee ... @isoutamo 's rex query is working fine and extracting the status msg(did you add the plus sign and the field=_raw or ur fieldname?). Please check the screenshot:

| makeresults 
| eval log="2020-10-18 14:06:18 [bp-[507bbd99]-completeMachineRun-233466] HitService [INFO] Created typed run Run: id=233467, uuid=7653767a-5e85-409d-aa3e-69bbeac40ad0 name=Final Results {size:0, status:READY_TO_PROCESS, rootRun:7653767a-5e85-409d-aa3e-69bbeac40ad0, data:}" 
| rex field=log "(?<status>status:[^,]+)" | table status

 rex-status.jpg

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...