Splunk Search

Extraction skipping within the value

srinivas_gowda
Path Finder

Hello all,

 

I am trying to extract a field from the below event and the extraction is missing the last part of the field. Please help in getting this extracted.

Event:

117691777,00004105,00000000,5064,"20211202100006","20211202100006",4,-1,-1,"SYSTEM","","IPSC002",94882466,"MS932","Server-I ジョブ(Server:/IZ_SSYS_DB/DAILY/MP7/MP_D41/物流ルートテーブルデータ送信:@20H7984)を開始します(host: Host, JOBID: 229589)","Information","tdi01","/HITACHI/JP1/AJS2","JOB","AJSROOT1:/IZ_SSYS_DB/DAILY/MP7/MP_D41/物流ルートテーブルデータ送信","JOBNET","Server:/IZ_SSYS_DB/DAILY/MP7","Server:/IZ_SSYS_DB/DAILY/MP7/MP_D41/物流ルートテーブルデータ送信","START","20211202100006","","",16,"A0","Server:/IZ_SSYS_DB/DAILY","A1","MP7","A2","MP_D41/物流ルートテーブルデータ送信","A3","@20H7984","ACTION_VERSION","0600","B0","n","B1","2","B2","tdi01","B3","IPSC002","C0","IPSC202","C1","","C6","r","H2","188677","H3","pj","H4","q","PLATFORM","NT",

 

Extraction used:

(?:[^,]+,){14}(?<alert_description>[^,]+),

 

However the same extraction is working on the below event as expected.

117727680,00004103,00000000,5064,"20211202172828","20211202172828",4,-1,-1,"SYSTEM","","IPSC002",94918000,"MS932","Server-I (Server:/HTHACHU/IJH03/IJH03:@20I8438)","Information","tdi01","/HITACHI/JP1/AJS2","JOBNET","AJSROOT1:/HTHACHU/IJH03/IJH03","JOBNET","AJSROOT1:/HTHACHU/IJH03/IJH03","AJSROOT1:/HTHACHU/IJH03/IJH03","END","20211202172827","20211202172828","",10,"A0","AJSROOT1:/HTHACHU/IJH03","A1","IJH03","A3","@20I8438","ACTION_VERSION","0600","B0","n","B1","0","B3","IPSC002","H2","853876","H3","n","PLATFORM","NT",

Please help extract the highlighted field.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Your alert has a comma in so try this

(?:[^,]+,){14}(?<alert_description>\"[^\"]*\"),

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Your alert has a comma in so try this

(?:[^,]+,){14}(?<alert_description>\"[^\"]*\"),