Splunk Search

Extract fields using colon (:) except time field

richnavis
Contributor

Hello,
I'm trying to use the field extraction tool for a data file that where the fields are delineated by a colon(:). However, the time fields ALSO contains a colon, so it doesn't extract this field correctly. Any thoughts on how to work around this? Sample Event Below

INFO : LM_36488 [Thu Jan 18 17:00:18 2018] : (11616|15356) Session task instance [Big_Data_Job] : [TM_6721 Started [Fetch Session from Repository].]

Predictably, this gets broken out like this
INFO
LM_36488 Thu Jan 18 17
00
18 2018
Session task instance [Big_Data_Job]
[TM_6721 Started [Fetch Session from Repository].]

horsefez
Motivator

@richnavis, any success with trying out the suggested solutions yet?

0 Karma

mayurr98
Super Champion

hey try this run anywhere search

| makeresults | eval _raw="INFO : LM_36488 [Thu Jan 18 17:00:18 2018] : (11616|15356) Session task instance [Big_Data_Job] : [TM_6721 Started [Fetch Session from Repository].]" | rex field=_raw "^(?<field1>[^\:]+)\s:\s(?<field2>[^\]]+])\s:\s(?<field3>[^\]]+])\s:\s(?<field4>.*)"

In your environment you should write

<your_base_search> |rex field=_raw "^(?<field1>[^\:]+)\s:\s(?<field2>[^\]]+])\s:\s(?<field3>[^\]]+])\s:\s(?<field4>.*)"

let me know if this helps!

horsefez
Motivator

Hey richnavis,

when you do field extractions do "regular expressions" instead of "delimeters".
Then click "write your regular expression yourself" and paste this regex in:
(?<field1>[^\:]+)\s+?\:\s+?(?<field2>[^\[]+)\s+?\[(?<date>[^\]]+)\]\s+?\:\s+?(?<field4>[^\:]+)\s+?\:\s+?(?<field5>[^$]+)

substitute the "fieldX" values with the names your actual fields should have

Cheers!

https://regex101.com/r/ghD0XE/2

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...