Splunk Search

Extract value from field

CesarCrt
Path Finder

Hello everyone,

I have multiple fields and i want to extract an ID from it. (That's the only value that changes in it)

My fields are : class, method, message, nb.

Message field is like this : "] id not found for opp : [12345azeAZE"
I wanted to extract the value after the "[" (in bold) and create a message with it.

Can i have a result like this please :
There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$.

Thanks.

Labels (3)
0 Karma
1 Solution

CesarCrt
Path Finder

I found the solution with your help @vnravikumar 

 

| rex field=my_message ":\s\[(?P<result>[^\"]+)"
| stats count as nb by result
| fields nb, result
| multikv forceheader=1
| strcat "- ", nb, " error(s) with the opportunity ",result message
| fields message
| mvcombine message delim="
"
| nomv message

View solution in original post

0 Karma

CesarCrt
Path Finder

I found the solution with your help @vnravikumar 

 

| rex field=my_message ":\s\[(?P<result>[^\"]+)"
| stats count as nb by result
| fields nb, result
| multikv forceheader=1
| strcat "- ", nb, " error(s) with the opportunity ",result message
| fields message
| mvcombine message delim="
"
| nomv message
0 Karma

CesarCrt
Path Finder

Thanks for your answer @vnravikumar 

It works for the extraction but, i forgot to say that this ID change a lot and with your solution, i only extract one of them.

 

i have a list of them :

"] id not found for opp : [12345azeAZE"  (A)
"] id not found for opp : [12345azeAZE"  (A)
"] id not found for opp : [12345azeAZE"  (A)


"] id not found for opp : [75895kezWXE" (B)
"] id not found for opp : [75895kezWXE" (B)


"] id not found for opp : [35856uioAME" (C)

"] id not found for opp : [35856uioAME" (C)

 

And i want to extract the ID with the number of time that appears

Ex:  (the method and the class doesn't change)

There are $nb$ errors from the method: $method$ with the class: $class$ on the opp: $message$.

There are 3 errors from the method: $method$ with the class: $class$ on the opp: (A)
There are 2 errors from the method: $method$ with the class: $class$ on the opp: (B)
There are 2 errors from the method: $method$ with the class: $class$ on the opp: (C)

 

Thanks.

0 Karma

vnravikumar
Champion

Hi

 

Try this

 

| makeresults 
| eval message="\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [12345azeAZE\"  (A),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [35856uioAME\" (C),
\"] id not found for opp : [35856uioAME\" (C)" 
| makemv delim="," message 
| mvexpand message 
| rex field=message ":\s\[(?P<test>[^\"]+)" 
| stats count by test
0 Karma

CesarCrt
Path Finder

I can't do this because, i didn't know the ID (the part after "opp:")  by advance and i had a lot of results.

] id not found for opp : [12345azeAZE

I need to summarize the results with the ID extracted and the number of time it appears.

0 Karma

vnravikumar
Champion

Hi

 

Try this rex

| makeresults 
| eval message=" \"] id not found for opp : [12345azeAZE\"" 
| rex field=message ":\s\[(?P<test>[^\"]+)"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...