Splunk Enterprise

need help on regex

vishwa
Path Finder

sample log:

{"date" : "2021-01-01 00:00:00.123 | dharam=fttc-pb-12312-esse-4 | appLevel=INRO | appName=REME_CASHE_ATTEMPT_PPI | env=sit | hostName=apphost000adc | pointer=ICFD | applidName=http.ab.web.com|news= | list=OUT_GOING | team=norpass | Category=success | status=NEW | timeframe=20", "tags": {"host": "apphost000adc" ,  "example": "6788376378jhjgjhdh2h3jhj2", "region": null, "resource": "add-njdf-tydfth-asd-1"}}

used below regex to extract all fields  , but  one field is not getting extracted, that is timeframe
|regex  _raw= (\w+)\=(.+?) \|

how to modify my regex to extract timeframe field as well.

Labels (1)
0 Karma

SierraX
Communicator

Hi,
regex _raw is here the wrong command…
regex - Splunk Documentation
but rex seems wrong too

rex - Splunk Documentation

because it can't do a key value extraction in search.
I found an odd way tho handle this:

| spath | rename _raw AS temp date AS _raw | extract pairdelim="|" kvdelim="=" | rename _raw as date temp as _raw


reference: extract - Splunk Documentation
Is this what you are searching for?
Bildschirmfoto 2024-04-09 um 20.14.19.png

Kind Regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The timeframe field is not terminated by a pipe, like the other fields, so the regex doesn't match.  Try this:

| rex "(\w+)=([^\|\"]+)"
---
If this reply helps you, Karma would be appreciated.

vishwa
Path Finder

thanks it worked

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...