Splunk Search

Extract value from field

CesarCrt
Path Finder

Hello everyone,

I have multiple fields and i want to extract an ID from it. (That's the only value that changes in it)

My fields are : class, method, message, nb.

Message field is like this : "] id not found for opp : [12345azeAZE"
I wanted to extract the value after the "[" (in bold) and create a message with it.

Can i have a result like this please :
There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$.

Thanks.

Labels (3)
0 Karma
1 Solution

CesarCrt
Path Finder

I found the solution with your help @vnravikumar 

 

| rex field=my_message ":\s\[(?P<result>[^\"]+)"
| stats count as nb by result
| fields nb, result
| multikv forceheader=1
| strcat "- ", nb, " error(s) with the opportunity ",result message
| fields message
| mvcombine message delim="
"
| nomv message

View solution in original post

0 Karma

CesarCrt
Path Finder

I found the solution with your help @vnravikumar 

 

| rex field=my_message ":\s\[(?P<result>[^\"]+)"
| stats count as nb by result
| fields nb, result
| multikv forceheader=1
| strcat "- ", nb, " error(s) with the opportunity ",result message
| fields message
| mvcombine message delim="
"
| nomv message
0 Karma

CesarCrt
Path Finder

Thanks for your answer @vnravikumar 

It works for the extraction but, i forgot to say that this ID change a lot and with your solution, i only extract one of them.

 

i have a list of them :

"] id not found for opp : [12345azeAZE"  (A)
"] id not found for opp : [12345azeAZE"  (A)
"] id not found for opp : [12345azeAZE"  (A)


"] id not found for opp : [75895kezWXE" (B)
"] id not found for opp : [75895kezWXE" (B)


"] id not found for opp : [35856uioAME" (C)

"] id not found for opp : [35856uioAME" (C)

 

And i want to extract the ID with the number of time that appears

Ex:  (the method and the class doesn't change)

There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$.

There are 3 errors from the method: $method$ with the class: $class$ on the opp: (A)
There are 2 errors from the method: $method$ with the class: $class$ on the opp: (B)
There are 2 errors from the method: $method$ with the class: $class$ on the opp: (C)

 

Thanks.

0 Karma

vnravikumar
Champion

Hi

 

Try this

 

| makeresults 
| eval message="\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [35856uioAME\" (C),
\"] id not found for opp : [35856uioAME\" (C)" 
| makemv delim="," message 
| mvexpand message 
| rex field=message ":\s\[(?P<test>[^\"]+)" 
| stats count by test
0 Karma

CesarCrt
Path Finder

I can't do this because, i didn't know the ID (the part after "opp:")  by advance and i had a lot of results.

] id not found for opp : [12345azeAZE

I need to summarize the results with the ID extracted and the number of time it appears.

0 Karma

vnravikumar
Champion

Hi

 

Try this rex

| makeresults 
| eval message=" \"] id not found for opp : [12345azeAZE\"" 
| rex field=message ":\s\[(?P<test>[^\"]+)"
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...