Splunk Search

Extracting field with a guid as an end anchor

Cuyose
Builder

For some reason I have not been able to get a field extraction to work where the end anchor will be a GUID. Basically the events are as follows

Exception=This is the exception - wrong thing here. - 32c18521-1313-41e6-8ff6-1e1fb986a321

What would the field extraction for this look like?

This isn't even working for me
(?i)Exception=(?P[^[0-9a-f]{8}]+)

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This works on regex101 using your sample data.

Exception=(?P<exception>.*)(?P<GUID>.{8}-.{4}-.{4}-.{4}-.{12})
---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
Revered Legend

Give this a try

(?i)Exception=(?P<Exception>.*)(\s*-+\s*)\w{8}-\w{4}-\w{4}-\w{4}-\w{12}$
0 Karma

Cuyose
Builder

This has worked! Thanks. Odd though, When I was changing the field extraction in the manager, then rerunning the query, I was not noticing the extraction. Only when I edited the existing search then ran did it get the correct extractions. Re-pasting the original then also got the extractions.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What exactly do you want extracted from your sample event?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Cuyose
Builder

This is what I am attempting to extract
This is the exception - wrong thing here.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does the exception always end with '.'? We can't stop at an 8-character word or we risk losing part of the exception text.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Cuyose
Builder

No it does not always end with a . I want to set the logic to:
Capture everything between Exception= and a GUID, which will always be 8-4-4-4-12 alphanumeric characters.

I know this is totally doable, but I am not able to get splunks version of regex to work.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...