Splunk Search

Extract Multiple fields

jayeshrajvir
Explorer

Sample data

[A028 : 00]
[F037 : 928323177452]
[F038 : 456137]
[F039 : 0]

The query below is working but i wanted to merge, basically i wanted to use rex field=_raw just once. How to extract multiple fields

index=au_axs_common_log sourcetype=anz_axs_auth_core_log "[A028" |rex field=_raw "(\[F039\s*:(?.*?)\])"| rex field=_raw "\[A028\s*:(?.*?)\]" |stats count by axrc,vrc

Labels (1)
Tags (1)
0 Karma

jayeshrajvir
Explorer

jayeshrajvir_0-1647344653392.png

 

@venky1544 It fetches/matching all the four fields. I wanted to match only two fields. Can you please share your thoughts.

0 Karma

venky1544
Builder

Hi @jayeshrajvir 

PFB screenshot hope this helps 

| makeresults |eval new = "[A028 : 00]"
|append [|makeresults |eval new="[F037 : 928323177452]"]
|append [|makeresults |eval new="[F038 : 456137]"]
|append [|makeresults |eval new="[F039 : 0]"]
|rex field=new "(\[A028|\[F038)\s:\s(?<num>\d+)\]"

 

venky1544_0-1647348590034.png

 

0 Karma

venky1544
Builder

hi @jayeshrajvir 

try this regex \[\w+\s:\s\d+\]

just curious what are you doing with the regex coz there is no named group in the regex  ??

is this a tweaked query you pasted here 

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...