Splunk Search
Highlighted

Field Extraction problem

Communicator

I am trying to extract some data from a script output.
Sample:
SERVICENAME: WebTrends - Data Retention Service
DISPLAY
NAME: WebTrends - Data Retention Service
TYPE : 10 WIN32OWNPROCESS

STATE : 1 STOPPED
WIN32EXITCODE : 0 (0x0)
SERVICEEXITCODE : 0 (0x0)
CHECKPOINT : 0x0
WAITHINT : 0x0
I have checked successfully the Generated pattern (regex) with the Interactive Field Extractor and also using a query.
index=main sourcetype="services
monitoringstatus" | head 10000 | rex "(?i)SERVICENAME: (?P.+)"
But curiously if I save this regex as a Field extraction doesn’t work…because not only take the name. It takes all the rest of the event, not break at the end of the line.
Expected behavior:
Namefield = WebTrends - Data Retention Service
Incorrect behavior:
Namefield= WebTrends - Data Retention Service DISPLAYNAME: WebTrends - Data Retention Service TYPE : 10 WIN32OWNPROCESS STATE : 1 STOPPED WIN32EXITCODE : 0 (0x0) SERVICEEXITCODE : 0 (0x0) CHECKPOINT : 0x0 WAITHINT : 0x0
So How is possible this differents behavior doing the same?

Tags (3)
0 Karma
Highlighted

Re: Field Extraction problem

Contributor

try this

rex "(?i)SERVICE_NAME:\s+(?P<fieldname>.+)([\r\n\s]+)"
0 Karma
Highlighted

Re: Field Extraction problem

Communicator

This regex in a query works as well

index=main sourcetype="servicesmonitoringstatus" | head 10000 | rex "(?i)SERVICE_NAME:\s+(?P.+)([\r\n\s]+)"

But If I save it as a field extraction in the console, it returns the same wrong values…as mine

(?i)SERVICE_NAME:\s+(?P.+)([\r\n\s]+)

Is strange that could returns different results depending on how you apply the regex.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.