Splunk Search

Context based regex field extraction

shrirangphadke
Path Finder

Hi,

I am trying to extract few fields out of logs but Splunk field extraction is not working in my case.

For example:

2015-06-17 13:48:55,689 abc-field [SystemEvent] Time:'June 17, 2015 8:48:55 PM GMT',Severity:'Critical', Event Source:'domain-c0', Code:'301503', Event Message:'Failed to publish abcd configuration version 1408159473758 to cluster domain-c0. Refer logs for details', Module:'abcd something'

2015-06-17 13:48:55,620 abc-xyz-something June 17, 2015 8:48:55 PM GMT INFO SimpleAsyncTaskExecutor-1 SystemEventDaoImpl:124 - [SystemEvent] Time:'June 17, 2015 8:48:55 PM GMT',Severity:'Informational', Event Source:'edge-0', Code:'30101', Event Message:'abcd was booted', Module:'abcd something Appliance'

In above two log snippets I am trying to extract value of the field "Severity".
But since the position of field "Severity" in both the logs are different Splunk returns the field such as:
1. Critical
2. June

Probably it is because Splunk does regex parsing based on position.

I want to extract the fields based on pre-context and post-context.
For example:
Pre-context: "Severity:'"
Required value
Post-context: "', Event"

I am completely stuck here. Please help.

0 Karma
1 Solution

woodcock
Esteemed Legend

Assuming these are the only 2 variants, try this:

... | rex "^.*?Severity\s*:\s*'?(?<Severity>[^'\s]+)"

View solution in original post

woodcock
Esteemed Legend

Assuming these are the only 2 variants, try this:

... | rex "^.*?Severity\s*:\s*'?(?<Severity>[^'\s]+)"

shrirangphadke
Path Finder

Thank you very much for your answer !
Now it will take me another day to understand this 😛

0 Karma

shrirangphadke
Path Finder

Is there any Splunk regex tutorial which I can follow ?

0 Karma

woodcock
Esteemed Legend

I learned by doing but that's just the way I am. So although I cannot help you much there, I can suggest some tools. My favorite is Expresso which is free. I use this almost every day. It does a good job of "translating" the RegEx to english on the right side so that when somebody gives you a solution (like I did), it will show you bit-by-bit which each part of the RegEx is doing.

0 Karma

shrirangphadke
Path Finder

This is exactly what I wanted thank you very much!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...