Splunk Enterprise

need help on regex

vishwa
Path Finder

sample log:

{"date" : "2021-01-01 00:00:00.123 | dharam=fttc-pb-12312-esse-4 | appLevel=INRO | appName=REME_CASHE_ATTEMPT_PPI | env=sit | hostName=apphost000adc | pointer=ICFD | applidName=http.ab.web.com|news= | list=OUT_GOING | team=norpass | Category=success | status=NEW | timeframe=20", "tags": {"host": "apphost000adc" ,  "example": "6788376378jhjgjhdh2h3jhj2", "region": null, "resource": "add-njdf-tydfth-asd-1"}}

used below regex to extract all fields  , but  one field is not getting extracted, that is timeframe
|regex  _raw= (\w+)\=(.+?) \|

how to modify my regex to extract timeframe field as well.

Labels (1)
0 Karma

SierraX
Communicator

Hi,
regex _raw is here the wrong command…
regex - Splunk Documentation
but rex seems wrong too

rex - Splunk Documentation

because it can't do a key value extraction in search.
I found an odd way tho handle this:

| spath | rename _raw AS temp date AS _raw | extract pairdelim="|" kvdelim="=" | rename _raw as date temp as _raw


reference: extract - Splunk Documentation
Is this what you are searching for?
Bildschirmfoto 2024-04-09 um 20.14.19.png

Kind Regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The timeframe field is not terminated by a pipe, like the other fields, so the regex doesn't match.  Try this:

| rex "(\w+)=([^\|\"]+)"
---
If this reply helps you, Karma would be appreciated.

vishwa
Path Finder

thanks it worked

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...