Splunk Search

Extracting through inconsistent data

srinivas_gowda
Path Finder

Hello all,

 

Have been trying to extract the values through an inconsistent data as below. Highlighted values needs to be extracted, however the default extrcation through the tool is not working as expected. Could you please help in this.


50271234,00004105,00000000,1600,"20210901225500","20210901225500",4,-1,-1,"SYSTEM","","psd217",46769359,"MS932","KAVS0263-I \x83W\x83\x87\x83u(AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B:@5V689)\x82\xF0\x8AJ\x8En\x82\xB5\x82܂\xB7(host: UXC510, JOBID: 56620)","Information","jp1admin","/Example/JP1/AJS2","JOB","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B","JOBNET","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX/V9B01_B","START","20210901225500","","",16,"A0","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds","A1","04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","A2","V9B01_B","A3","@5V0689","ACTION_VERSION","0600","B0","n","B1","1","B2","jp1admin","B3","psd217","C0","UXC510","C1","","C6","r","H2","677758","H3","j","H4","q","PLATFORM","NT",

 

 

50270531,00003A71,00000000,3588,"20210901224800","20210901224800",4,-1,-1,"SYSTEM","","PSC611",565029,"MS932","""SE_LOG: User - GetStringS: Failed to LookupAccountName. Domain (\\SERVER-retailing.group), Name (SERVER\QVADMIN). System Error""","Error","","/Example/JP1/NTEVENT_LOGTRAP/QlikViewServer","LOGFILE","NTEVENTLOG","LOGFILE","NTEVENTLOG","","","","","",9,"A0","1630504080","A1","PSC611.H2O-retailing.group","A2","Application","A3","Error","A4","None","A5","300","A6","N/A","PLATFORM","NT","PPNAME","/HITACHI/JP1/NTEVENT_LOGTRAP",

 

Highlighted fields are the ones I am trying to extract here.

 

Thank you

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help if you said how the tool (which tool?) is not living up to expectations.

Have you tried this regex?

(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}"(?<field2>[^"]+)","(?<field3>[^"]+)","(?<field4>[^"]+)","(?<field5>[^"]+)",".*?","(?<field6>[^"]+)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would help if you said how the tool (which tool?) is not living up to expectations.

Have you tried this regex?

(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}"(?<field2>[^"]+)","(?<field3>[^"]+)","(?<field4>[^"]+)","(?<field5>[^"]+)",".*?","(?<field6>[^"]+)
---
If this reply helps you, Karma would be appreciated.

srinivas_gowda
Path Finder

Hello,

 

I tried and I am getting the below error.

Error in 'SearchParser': Missing a search command before '^'. Error at position '92' of search query 'search index=*jp1* | rex field=_raw "(?:[^,]+,){3}...{snipped} {errorcontext = ?<field2>[^"]+)","(?<}'.

 

And when I use escape before the " like below

| rex field=_raw "(?:[^,]+,){3}(?<field1>[^,]+),(?:[^,]+,){9}\"(?<field2>[^"]+)\",\"(?<field3>[^"]+)\",\"(?<field4>[^"]+)\",\"(?<field5>[^"]+)\",\".*?\",\"(?<field6>[^"]+)"

Still the below error.

Error in 'SearchParser': Mismatched ']'.

 

Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Quotation marks embedded in the rex command must be escaped with three backslashes.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...