Splunk Search

Extract raw data for URL into field

nbhat
Explorer

Hi,

In the following log, I wanted to extract Url, Method, ResponseTimeMs, StatusCode as a table:

log: a_level="INFO", a_time="null", a_sub="xxx", a_uid="xx", a_tid="xx", a_rid="guid", a_thread="175" a_type="type", a_met="Move", a_msg="Method=GET,Uri=http://monolith-xxx.abc.com/v2/clients?skip=0top=100,MediaType=null,RemoteIP=::ffff:10.10.10.10,XRem...

For URL, I wanted the full extract "http://monolith-xxx.abc-xyz/v2/clients?skip=0top=100

My current splunk query is as below:

index=aws_abc env=prd-01 uri Method StatusCode ResponseTimeMs
| eval DataSet=log
| rex field=DataSet "ResponseTimeMs=(?<ResponseTimeMs>\d+),StatusCode=(?<StatusCode>\d+)"
| rex field=DataSet "Url=(?<uri>[^,]+),Method=(?<Method>\w+)"
| table Url,Method,ResponseTimeMs, StatusCode

I get value in the table for ResponseTimeMs, StatusCode but not for URL and Method. Please help. Thanks

Labels (3)
0 Karma
1 Solution

johnhuang
Motivator

Not sure if there's typos in the example you've provided, the string after "a_msg" seems inconsistent with previous format.

Anyways, this was written have some flexibilty  in accomodating possible typos your event example.

 

 

| rex field=DataSet "\"?Method\"?\=(?<Method>[^,]*)\,Uri=(?<uri>[^\,]+)"

 

 

 

View solution in original post

0 Karma

johnhuang
Motivator

Not sure if there's typos in the example you've provided, the string after "a_msg" seems inconsistent with previous format.

Anyways, this was written have some flexibilty  in accomodating possible typos your event example.

 

 

| rex field=DataSet "\"?Method\"?\=(?<Method>[^,]*)\,Uri=(?<uri>[^\,]+)"

 

 

 

0 Karma

nbhat
Explorer

Thank you very much 

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...