Field Extraction using Regex

abilann · ‎04-10-2020

Hi Team,

I would like to extract table name from below combined event using rex. Both events are combined in one event using transaction. Can you please help,

25324/-285213840 WRK:DF_E4CAC858_tor Thu Apr 9 23:17:25.077194 dbprq.c770
doQueryDiagnostics: The following SQL query took 535 seconds which is equal to or greater than QueryExecutionTimeThreshold (4 seconds) for User(AF) with DBProxyUser(AF).
25324/-285213840 WRK:AF_E4CAC858_tor Thu Apr 9 23:17:25.080304 dbpq.c782
SELECT * FROM PRODDTA.Employee WHERE ( A=1 )

Thanks,
Abilan

richgalloway · ‎04-10-2020

See if this helps.

... | rex "(?i)FROM (?<table>\S+)"

---
If this reply helps you, Karma would be appreciated.

Field Extraction using Regex

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Developer Spotlight with Denis Gladkikh

Governing Enterprise AI, Bringing Cisco Telemetry Home, and More from Splunk Lantern

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Join the Conversation

Field Extraction using Regex

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Developer Spotlight with Denis Gladkikh

Governing Enterprise AI, Bringing Cisco Telemetry Home, and More from Splunk Lantern

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM