Splunk Search

Extract text from message field

codedtech
Path Finder

I need to extract a string from a message body,  and make a new field for it.  

<Junk_Message> #body | Thing1 | Stuff2  | meh4 | so on 1 | extra stuff3 | Blah4 </Junk_Message>
I just need the text that start with #body and end with Blah4. To make things more fun everything after #body generates randomly.




Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and how those attempts failed you.

One method that works well for me is the rex command.  This regex matches everything after "Junk_Message>" until the following "<" and puts it into a field called Junk_Message.

| rex "Junk_Message>(?<Junk_Message>[^\<])"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would help to know what you've tried so far and how those attempts failed you.

One method that works well for me is the rex command.  This regex matches everything after "Junk_Message>" until the following "<" and puts it into a field called Junk_Message.

| rex "Junk_Message>(?<Junk_Message>[^\<])"

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...