Splunk Search

Extracting through inconsistent data

srinivas_gowda
Path Finder

Hello all,

 

Have been trying to extract the values through an inconsistent data as below. Highlighted values needs to be extracted, however the default extrcation through the tool is not working as expected. Could you please help in this.


50271234,00004105,00000000,1600,"20210901225500","20210901225500",4,-1,-1,"SYSTEM","","psd217",46769359,"MS932","KAVS0263-I \x83W\x83\x87\x83u(AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B:@5V689)\x82\xF0\x8AJ\x8En\x82\xB5\x82܂\xB7(host: UXC510, JOBID: 56620)","Information","jp1admin","/Example/JP1/AJS2","JOB","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B","JOBNET","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B","START","20210901225500","","",16,"A0","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds","A1","04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","A2","V9B01_B","A3","@5V0689","ACTION_VERSION","0600","B0","n","B1","1","B2","jp1admin","B3","psd217","C0","UXC510","C1","","C6","r","H2","677758","H3","j","H4","q","PLATFORM","NT",

 

 

50270531,00003A71,00000000,3588,"20210901224800","20210901224800",4,-1,-1,"SYSTEM","","PSC611",565029,"MS932","""SE_LOG: User - GetStringS: Failed to LookupAccountName. Domain (\\SERVER-retailing.group), Name (SERVER\QVADMIN). System Error""","Error","","/Example/JP1/NTEVENT_LOGTRAP/QlikViewServer","LOGFILE","NTEVENTLOG","LOGFILE","NTEVENTLOG","","","","","",9,"A0","1630504080","A1","PSC611.H2O-retailing.group","A2","Application","A3","Error","A4","None","A5","300","A6","N/A","PLATFORM","NT","PPNAME","/HITACHI/JP1/NTEVENT_LOGTRAP",

 

Highlighted fields are the ones I am trying to extract here.

 

Thank you

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help if you said how the tool (which tool?) is not living up to expectations.

Have you tried this regex?

(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}"(?<field2>[^"]+)","(?<field3>[^"]+)","(?<field4>[^"]+)","(?<field5>[^"]+)",".*?","(?<field6>[^"]+)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would help if you said how the tool (which tool?) is not living up to expectations.

Have you tried this regex?

(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}"(?<field2>[^"]+)","(?<field3>[^"]+)","(?<field4>[^"]+)","(?<field5>[^"]+)",".*?","(?<field6>[^"]+)
---
If this reply helps you, an upvote would be appreciated.

srinivas_gowda
Path Finder

Hello,

 

I tried and I am getting the below error.

Error in 'SearchParser': Missing a search command before '^'. Error at position '92' of search query 'search index=*jp1* | rex field=_raw "(?:[^,]+,){3}...{snipped} {errorcontext = ?<field2>[^"]+)","(?<}'.

 

And when I use escape before the " like below

| rex field=_raw "(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}\"(?<field2>[^"]+)\",\"(?<field3>[^"]+)\",\"(?<field4>[^"]+)\",\"(?<field5>[^"]+)\",\".*?\",\"(?<field6>[^"]+)"

Still the below error.

Error in 'SearchParser': Mismatched ']'.

 

Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Quotation marks embedded in the rex command must be escaped with three backslashes.

---
If this reply helps you, an upvote would be appreciated.
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>