Splunk Search

Extracting text from event using search

fabiozihlmann
Engager

Hi I am trying to make a dashboard that searches events and extracts the correlationId from the event so I can display that information in a cleaner manner.  I just want to be able to extract the correlationId using my search and it comes in two main patterns. 

The first event pattern 

fabiozihlmann_2-1598973973588.png

 

and the second pattern

fabiozihlmann_1-1598973907266.png

 

My current search is 

fabiozihlmann_3-1598974103838.png

My ultimate goal is to make a table with a Correlation ID column and other vital information columns

 

I have not edited the source code yet, so please feel free to leave any feedback or clarifying questions if needed

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please post text rather than screen shots so we can use it in test cases.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| rex "correlationId(='| )(?<correlationId>[0-9a-fA-F-]+)"

Single quote might need escaping with a back-slash i.e. (=\'| )

 

Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...