Splunk Search

Extracting multiple fields from a line

cutenemo
Engager

I have a line that contains 2 different fields that I need

Right now I have:
index=os sourcetype="xxx" | regex _raw="\d tests, \d assertions, \d failures, \d errors"

Which returns for example:
2 tests, 2 assertions, 0 failures, 0 errors

How can I extract the fields tests and failures? would it be possible?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

somesoni2
Revered Legend

Can you post some sample logs? Based on that people will be able to help you with field extractions.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

regex filters results, use rex to extract fields in a search: http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/rex

martin_mueller
SplunkTrust
SplunkTrust

I'm guessing this:

... | rex "(?<tests>\d+) tests, (?<assertions>\d+) assertions, (?<failures>\d+) failures, (?<errors>\d+) errors"

However, without seeing your actual events that's only that, a guess.

0 Karma

cutenemo
Engager

the number actually comes before \d tests

0 Karma

cutenemo
Engager

can you post how we can do it with rex, I'm still struggling

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...