Splunk Search

Extracting fields from _raw in Splunk

ashraf_sj
Explorer

Hi All,

I'm trying to extract 2 fields from _raw but seems to be a bit of struggle

I want to extract ERRTEXT and MSGXML, have tried using the option of extraction from Splunk and below are the rex I got,

The issue with the below rex for ERRTEXT is that it pulls all the MSGXML content as well. 

If there could be regex to extract something after ERRTEXT and MSGXML it would be great 

| rex field=_raw "^(?:[^=\n]*=){7}(?P<ERRTEXT>.+)"
| rex field=_raw "^(?:[^=\n]*=){8}(?P<MSGXML>.+)"


Sample of the data that has been ingested in Splunk, this is data is from Splunk DB connect that is getting pushed over to Splunk 

2021-12-09 09:56:00.998, FACILITY_DETAILS="/v1/facilities/XXXX/arrears", FACILITY_ID="101010/", TIMESTAMP="2021-12-09 03:41:06.768342", CORRELATION="414d51204d425032514d30322020xxxda4b", ORIGIN="FROMORIGIIN", ERRCODE="code":"400",", ERRTEXT="detail":"must be greater than the previously recorded value of 105 days","source":{"pointer":"/data/days_past_due"}}]}", MSGXML="{"errors":[{"id":"3a59de59-8b99-4e4a-abfb-XXXXXX","status":"400","code":"400","title":"days_past_due is invalid","detail":"must be greater than the previously recorded value of 105 days","source":{"pointer":"/data/days_past_due"}}]}"



2021-12-09 09:56:00.998, FACILITY_DETAILS="/v1/facilities/XXXX/arrears", FACILITY_ID="101010/", TIMESTAMP="2021-12-09 03:41:06.768342", CORRELATION="414d51204d425032514d30322020xxxda4b", ORIGIN="FROMORIGIIN", ERRCODE="code":"400",", ERRTEXT="detail":"must be greater than the previously recorded value of 105 days","source":{"pointer":"/data/days_past_due"}}]}", MSGXML="{"errors":[{"id":"3a59de59-8b99-4e4a-abfb-XXXXXX","status":"400","code":"400","title":"days_past_due is invalid","detail":"must be greater than the previously recorded value of 105 days","source":{"pointer":"/data/days_past_due"}}]}"

 

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=_raw "^(?:[^=\n]*=){7}(?P<ERRTEXT>.+), MSGXML"
| rex field=_raw "^(?:[^=\n]*=){8}(?P<MSGXML>.+)"

View solution in original post

ashraf_sj
Explorer

Both of the options work, I have accepted the first as an answer, though the second solution also works. . Thanks to @ITWhisperer  and @gcusello  for a prompt response. much appreciated and kudos for all your works

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=_raw "^(?:[^=\n]*=){7}(?P<ERRTEXT>.+), MSGXML"
| rex field=_raw "^(?:[^=\n]*=){8}(?P<MSGXML>.+)"

gcusello
SplunkTrust
SplunkTrust

Hi @ashraf_sj,

could you try this, please?

| rex "ERRTEXT=\"(?P<ERRTEXT>.+)\",\s+MSGXML"

that you can test at https://regex101.com/r/Rixa34/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...