Splunk Search

Extract fields using colon (:) except time field

richnavis
Contributor

Hello,
I'm trying to use the field extraction tool for a data file that where the fields are delineated by a colon(:). However, the time fields ALSO contains a colon, so it doesn't extract this field correctly. Any thoughts on how to work around this? Sample Event Below

INFO : LM_36488 [Thu Jan 18 17:00:18 2018] : (11616|15356) Session task instance [Big_Data_Job] : [TM_6721 Started [Fetch Session from Repository].]

Predictably, this gets broken out like this
INFO
LM_36488 Thu Jan 18 17
00
18 2018
Session task instance [Big_Data_Job]
[TM_6721 Started [Fetch Session from Repository].]

horsefez
SplunkTrust
SplunkTrust

@richnavis, any success with trying out the suggested solutions yet?

0 Karma

mayurr98
Super Champion

hey try this run anywhere search

| makeresults | eval _raw="INFO : LM_36488 [Thu Jan 18 17:00:18 2018] : (11616|15356) Session task instance [Big_Data_Job] : [TM_6721 Started [Fetch Session from Repository].]" | rex field=_raw "^(?<field1>[^\:]+)\s:\s(?<field2>[^\]]+])\s:\s(?<field3>[^\]]+])\s:\s(?<field4>.*)"

In your environment you should write

<your_base_search> |rex field=_raw "^(?<field1>[^\:]+)\s:\s(?<field2>[^\]]+])\s:\s(?<field3>[^\]]+])\s:\s(?<field4>.*)"

let me know if this helps!

horsefez
SplunkTrust
SplunkTrust

Hey richnavis,

when you do field extractions do "regular expressions" instead of "delimeters".
Then click "write your regular expression yourself" and paste this regex in:
(?<field1>[^\:]+)\s+?\:\s+?(?<field2>[^\[]+)\s+?\[(?<date>[^\]]+)\]\s+?\:\s+?(?<field4>[^\:]+)\s+?\:\s+?(?<field5>[^$]+)

substitute the "fieldX" values with the names your actual fields should have

Cheers!

https://regex101.com/r/ghD0XE/2

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...