Splunk Search

Field Extraction is not working in Splunk.

skukreja
New Member

I am working on MS Azure logs and some of the fields are not getting parsed so I tried to use the field extraction in splunk however I am not getting those field parsed after doing all the steps involved in field extraction.

I have tried both regex and delimiter based field extraction.

Appreciate any kind of help on this issue.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This regex string should extract the two fields you mentioned.

(?:[^;]+;){8}(?<storAcctName>[^;]+);(?:[^;]+;){5}(?<ipAddress>[^;]+);

If you want the IP address without port number, use this.

(?:[^;]+;){8}(?<storAcctName>[^;]+);(?:[^;]+;){5}(?<ipAddress>[^:]+):
---
If this reply helps you, Karma would be appreciated.
0 Karma

skukreja
New Member

Hi Rich,

All the fields are getting parsed in the field extractor wizard however they are not showing up in search.

Sumit Kukreja

0 Karma

skukreja
New Member

Hi Rich,

All the fields are getting parsed in the extract field wizard but still not getting them in search.

Sumit Kukreja

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you save the results of the extract field wizard?

---
If this reply helps you, Karma would be appreciated.
0 Karma

skukreja
New Member

Yes I do save them and I can see them in filed extraction tab.

mscs:storage:blob : EXTRACT-Method,Status,StorageAccount,IPAddress

My save field extraction name.

Sumit Kukreja

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I can't explain why it's not working.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Kindly post a sample of the log entries you wish to parse.

---
If this reply helps you, Karma would be appreciated.
0 Karma

skukreja
New Member

Hi Rich,

1.0;20170302T12:56:26.2817264Z;QueryTables;Success;200;6;6;authenticated;StorageAccountName;table;"https://StorageAccountName.table.core.windows.net:443/Tables";"/";xxxxx;0;**IP Address**:62615;2015-07-08;532;0;250;12;0;;;;;;"Azure-Storage/0.32.0 (Python CPython 2.7.11; Windows 2012ServerR2)";;"xxxxxx

I want to parse StorageAccountName & IP Address in the log.

0 Karma

svemurilv
Path Finder

Whats exact generated _raw event , past it here

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...