Splunk Search

Extracting through inconsistent data

srinivas_gowda
Path Finder

Hello all,

 

Have been trying to extract the values through an inconsistent data as below. Highlighted values needs to be extracted, however the default extrcation through the tool is not working as expected. Could you please help in this.


50271234,00004105,00000000,1600,"20210901225500","20210901225500",4,-1,-1,"SYSTEM","","psd217",46769359,"MS932","KAVS0263-I \x83W\x83\x87\x83u(AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B:@5V689)\x82\xF0\x8AJ\x8En\x82\xB5\x82܂\xB7(host: UXC510, JOBID: 56620)","Information","jp1admin","/Example/JP1/AJS2","JOB","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B","JOBNET","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B","START","20210901225500","","",16,"A0","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds","A1","04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","A2","V9B01_B","A3","@5V0689","ACTION_VERSION","0600","B0","n","B1","1","B2","jp1admin","B3","psd217","C0","UXC510","C1","","C6","r","H2","677758","H3","j","H4","q","PLATFORM","NT",

 

 

50270531,00003A71,00000000,3588,"20210901224800","20210901224800",4,-1,-1,"SYSTEM","","PSC611",565029,"MS932","""SE_LOG: User - GetStringS: Failed to LookupAccountName. Domain (\\SERVER-retailing.group), Name (SERVER\QVADMIN). System Error""","Error","","/Example/JP1/NTEVENT_LOGTRAP/QlikViewServer","LOGFILE","NTEVENTLOG","LOGFILE","NTEVENTLOG","","","","","",9,"A0","1630504080","A1","PSC611.H2O-retailing.group","A2","Application","A3","Error","A4","None","A5","300","A6","N/A","PLATFORM","NT","PPNAME","/HITACHI/JP1/NTEVENT_LOGTRAP",

 

Highlighted fields are the ones I am trying to extract here.

 

Thank you

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help if you said how the tool (which tool?) is not living up to expectations.

Have you tried this regex?

(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}"(?<field2>[^"]+)","(?<field3>[^"]+)","(?<field4>[^"]+)","(?<field5>[^"]+)",".*?","(?<field6>[^"]+)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would help if you said how the tool (which tool?) is not living up to expectations.

Have you tried this regex?

(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}"(?<field2>[^"]+)","(?<field3>[^"]+)","(?<field4>[^"]+)","(?<field5>[^"]+)",".*?","(?<field6>[^"]+)
---
If this reply helps you, Karma would be appreciated.

srinivas_gowda
Path Finder

Hello,

 

I tried and I am getting the below error.

Error in 'SearchParser': Missing a search command before '^'. Error at position '92' of search query 'search index=*jp1* | rex field=_raw "(?:[^,]+,){3}...{snipped} {errorcontext = ?<field2>[^"]+)","(?<}'.

 

And when I use escape before the " like below

| rex field=_raw "(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}\"(?<field2>[^"]+)\",\"(?<field3>[^"]+)\",\"(?<field4>[^"]+)\",\"(?<field5>[^"]+)\",\".*?\",\"(?<field6>[^"]+)"

Still the below error.

Error in 'SearchParser': Mismatched ']'.

 

Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Quotation marks embedded in the rex command must be escaped with three backslashes.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...