Splunk Search

Extract the words after Result=xxx

Satcom9
Engager

ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found

I want to extract the words that come after Result=XXX And not include the Result=xxx in the output.

|rex field=Message "(?<Test>\bResult.*\D+)"   This produces this output>>> Result=110 No Insertion Channel Found.

 

So I want to exclude the Results=XXX 

 

Labels (1)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Hi @Satcom9 

Pls check this(just a little tweak of your rex):

| makeresults | eval Message="ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found" |rex field=Message "Result=110(?<Test>\D+)" | table Message Test

but the 110 should not hard-coded.. try this instead. thanks. 

| makeresults | eval Message="ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found" |rex field=Message "Result=\d\d\d\s(?<Test>.*)" | table Message Test

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Satcom9 

Pls check this(just a little tweak of your rex):

| makeresults | eval Message="ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found" |rex field=Message "Result=110(?<Test>\D+)" | table Message Test

but the 110 should not hard-coded.. try this instead. thanks. 

| makeresults | eval Message="ACCU_DILAMZ9884 Failed, cueType=Splicer, SpliceEventID=0x00000BBC, SessionID=0x1A4D3100 SV event=454708529 spot=VAF00376_i pos=1 dur=0 Result=110 No Insertion Channel Found" |rex field=Message "Result=\d\d\d\s(?<Test>.*)" | table Message Test

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

Satcom9
Engager
|rex field=Message "Result=\d\d\d\s(?<Test>.*)"

 

I replaced yours with mine and it works perfectly for what I was looking for, TY for the response.

Satcom9_0-1725411986818.png

 

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...