Splunk Search

Extract raw data for URL into field

nbhat
Explorer

Hi,

In the following log, I wanted to extract Url, Method, ResponseTimeMs, StatusCode as a table:

log: a_level="INFO", a_time="null", a_sub="xxx", a_uid="xx", a_tid="xx", a_rid="guid", a_thread="175" a_type="type", a_met="Move", a_msg="Method=GET,Uri=http://monolith-xxx.abc.com/v2/clients?skip=0top=100,MediaType=null,RemoteIP=::ffff:10.10.10.10,XRem...

For URL, I wanted the full extract "http://monolith-xxx.abc-xyz/v2/clients?skip=0top=100

My current splunk query is as below:

index=aws_abc env=prd-01 uri Method StatusCode ResponseTimeMs
| eval DataSet=log
| rex field=DataSet "ResponseTimeMs=(?<ResponseTimeMs>\d+),StatusCode=(?<StatusCode>\d+)"
| rex field=DataSet "Url=(?<uri>[^,]+),Method=(?<Method>\w+)"
| table Url,Method,ResponseTimeMs, StatusCode

I get value in the table for ResponseTimeMs, StatusCode but not for URL and Method. Please help. Thanks

Labels (3)
0 Karma
1 Solution

johnhuang
Motivator

Not sure if there's typos in the example you've provided, the string after "a_msg" seems inconsistent with previous format.

Anyways, this was written have some flexibilty  in accomodating possible typos your event example.

 

 

| rex field=DataSet "\"?Method\"?\=(?<Method>[^,]*)\,Uri=(?<uri>[^\,]+)"

 

 

 

View solution in original post

0 Karma

johnhuang
Motivator

Not sure if there's typos in the example you've provided, the string after "a_msg" seems inconsistent with previous format.

Anyways, this was written have some flexibilty  in accomodating possible typos your event example.

 

 

| rex field=DataSet "\"?Method\"?\=(?<Method>[^,]*)\,Uri=(?<uri>[^\,]+)"

 

 

 

0 Karma

nbhat
Explorer

Thank you very much 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...