Splunk Search

Extract value from field

CesarCrt
Path Finder

Hello everyone,

I have multiple fields and i want to extract an ID from it. (That's the only value that changes in it)

My fields are : class, method, message, nb.

Message field is like this : "] id not found for opp : [12345azeAZE"
I wanted to extract the value after the "[" (in bold) and create a message with it.

Can i have a result like this please :
There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$.

Thanks.

Labels (3)
0 Karma
1 Solution

CesarCrt
Path Finder

I found the solution with your help @vnravikumar 

 

| rex field=my_message ":\s\[(?P<result>[^\"]+)"
| stats count as nb by result
| fields nb, result
| multikv forceheader=1
| strcat "- ", nb, " error(s) with the opportunity ",result message
| fields message
| mvcombine message delim="
"
| nomv message

View solution in original post

0 Karma

CesarCrt
Path Finder

I found the solution with your help @vnravikumar 

 

| rex field=my_message ":\s\[(?P<result>[^\"]+)"
| stats count as nb by result
| fields nb, result
| multikv forceheader=1
| strcat "- ", nb, " error(s) with the opportunity ",result message
| fields message
| mvcombine message delim="
"
| nomv message

View solution in original post

0 Karma

CesarCrt
Path Finder

Thanks for your answer @vnravikumar 

It works for the extraction but, i forgot to say that this ID change a lot and with your solution, i only extract one of them.

 

i have a list of them :

"] id not found for opp : [12345azeAZE"  (A)
"] id not found for opp : [12345azeAZE"  (A)
"] id not found for opp : [12345azeAZE"  (A)


"] id not found for opp : [75895kezWXE" (B)
"] id not found for opp : [75895kezWXE" (B)


"] id not found for opp : [35856uioAME" (C)

"] id not found for opp : [35856uioAME" (C)

 

And i want to extract the ID with the number of time that appears

Ex:  (the method and the class doesn't change)

There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$.

There are 3 errors from the method: $method$ with the class: $class$ on the opp: (A)
There are 2 errors from the method: $method$ with the class: $class$ on the opp: (B)
There are 2 errors from the method: $method$ with the class: $class$ on the opp: (C)

 

Thanks.

0 Karma

vnravikumar
Champion

Hi

 

Try this

 

| makeresults 
| eval message="\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [35856uioAME\" (C),
\"] id not found for opp : [35856uioAME\" (C)" 
| makemv delim="," message 
| mvexpand message 
| rex field=message ":\s\[(?P<test>[^\"]+)" 
| stats count by test
0 Karma

CesarCrt
Path Finder

I can't do this because, i didn't know the ID (the part after "opp:")  by advance and i had a lot of results.

] id not found for opp : [12345azeAZE

I need to summarize the results with the ID extracted and the number of time it appears.

0 Karma

vnravikumar
Champion

Hi

 

Try this rex

| makeresults 
| eval message=" \"] id not found for opp : [12345azeAZE\"" 
| rex field=message ":\s\[(?P<test>[^\"]+)"