Splunk Search

Field Extraction problem

bfernandez
Communicator

I am trying to extract some data from a script output.
Sample:
SERVICE_NAME: WebTrends - Data Retention Service
DISPLAY_NAME: WebTrends - Data Retention Service
TYPE : 10 WIN32_OWN_PROCESS

STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
I have checked successfully the Generated pattern (regex) with the Interactive Field Extractor and also using a query.
index=main sourcetype="services_monitoring_status" | head 10000 | rex "(?i)SERVICE_NAME: (?P.+)"
But curiously if I save this regex as a Field extraction doesn’t work…because not only take the name. It takes all the rest of the event, not break at the end of the line.
Expected behavior:
Namefield = WebTrends - Data Retention Service
Incorrect behavior:
Namefield= WebTrends - Data Retention Service DISPLAY_NAME: WebTrends - Data Retention Service TYPE : 10 WIN32_OWN_PROCESS STATE : 1 STOPPED WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0
So How is possible this differents behavior doing the same?

Tags (3)
0 Karma

hjwang
Contributor

try this

rex "(?i)SERVICE_NAME:\s+(?P<fieldname>.+)([\r\n\s]+)"
0 Karma

bfernandez
Communicator

This regex in a query works as well

index=main sourcetype="services_monitoring_status" | head 10000 | rex "(?i)SERVICE_NAME:\s+(?P.+)([\r\n\s]+)"

But If I save it as a field extraction in the console, it returns the same wrong values…as mine

(?i)SERVICE_NAME:\s+(?P.+)([\r\n\s]+)

Is strange that could returns different results depending on how you apply the regex.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...