Splunk Search

Extract variable between pipe symbol from log and use it for query

krishman23
Explorer

I have a log generated in splunk which will have unique id  in with pipe symbols:

ex:

 

 

 

 

19:46:47.146 - [http-nio-8000-exec-9] INFO edu.test.controller |{My Var1}|{My Var2}|{myVar3}| - {log message}.

 

 

 

 

I need to perform a query based on {My Var1}.

Also need to list (dedup) all logs best on {My Var1}.

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\|(?<Var1>[^\|]+)\|(?<Var2>[^\|]+)\|(?<Var3>[^\|]+)\|\s\-\s(?<logmessage>.*)"

View solution in original post

0 Karma

krishman23
Explorer

@ITWhisperer: i additional case in this rex, some time my logmessage will have URL as 

Req URL : hello/test/content

 or Req URL : hello/test/content/ , i need to truncate / of second request. Can you help with this ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=events mode=sed "s/(?<url>[^\/]+\/[^\/]+\/[^\/]+)(?<slash>\/*)/\1/g"
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\|(?<Var1>[^\|]+)\|(?<Var2>[^\|]+)\|(?<Var3>[^\|]+)\|\s\-\s(?<logmessage>.*)"
0 Karma

krishman23
Explorer

my bad , got it what you are saying.,

As second part of my question how can we user Var1 as variable for next search?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Depends on what you want to get out of your data

| dedup Var1
| where Var2="xyz"
| stats count by Var3
0 Karma

krishman23
Explorer

but var1,var2,var3  are unknown to me, those are variables in log

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The rex extracts the value between the first two pipes into a field called Var1, the value between the second and third pipes into a field called Var2, etc. You can then use these fields in your query or just display them in as columns in a table. Is this not what you want to do?

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...