Splunk Search

Field Extraction problem

bfernandez
Communicator

I am trying to extract some data from a script output.
Sample:
SERVICE_NAME: WebTrends - Data Retention Service
DISPLAY_NAME: WebTrends - Data Retention Service
TYPE : 10 WIN32_OWN_PROCESS

STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
I have checked successfully the Generated pattern (regex) with the Interactive Field Extractor and also using a query.
index=main sourcetype="services_monitoring_status" | head 10000 | rex "(?i)SERVICE_NAME: (?P.+)"
But curiously if I save this regex as a Field extraction doesn’t work…because not only take the name. It takes all the rest of the event, not break at the end of the line.
Expected behavior:
Namefield = WebTrends - Data Retention Service
Incorrect behavior:
Namefield= WebTrends - Data Retention Service DISPLAY_NAME: WebTrends - Data Retention Service TYPE : 10 WIN32_OWN_PROCESS STATE : 1 STOPPED WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0
So How is possible this differents behavior doing the same?

Tags (3)
0 Karma

hjwang
Contributor

try this

rex "(?i)SERVICE_NAME:\s+(?P<fieldname>.+)([\r\n\s]+)"
0 Karma

bfernandez
Communicator

This regex in a query works as well

index=main sourcetype="services_monitoring_status" | head 10000 | rex "(?i)SERVICE_NAME:\s+(?P.+)([\r\n\s]+)"

But If I save it as a field extraction in the console, it returns the same wrong values…as mine

(?i)SERVICE_NAME:\s+(?P.+)([\r\n\s]+)

Is strange that could returns different results depending on how you apply the regex.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...