Splunk Search

Field Extraction

jeck11
Path Finder

This has been asked a million times. I've been digging through the various postings but haven't figured out what I'm doing wrong. 

I'm able to do a search time extraction using the rex command to get a field exactly the way I want it. But then when I try to add it to the field extractors, it's including too much information. I need to extract the LINK_TARGET value from the event below but the USER details are also being included in the field extractor setup. 

Hopefully my redactions don't make this impossible for gurus to assist.

Search command: 

 

index="index" search_term | rex field=_raw "LINK_TARGET\s:\s(?<link_target>.*)\n"

 

 

Data:

 

2021-11-10 16:03:14.631 INFO  [blah] [Country=US] [User=user] [ip] [DefaultLynxMetricsLogger] [blah] [blah]  Metrics logging start: key blah_SEARCH_ORIGIN 
LINK_TARGET : https://www.blah.com/en_US/blah?utm_source=copy&utm_medium=blah&utm_campaign=blah
USER : 9999999
Metrics logging end

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this:

| rex field=_raw "LINK_TARGET\s:\s(?<link_target>\S*)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try this:

| rex field=_raw "LINK_TARGET\s:\s(?<link_target>\S*)"

jeck11
Path Finder

The rex command is already working in the search time extraction. I'm trying to define it as a field extraction and that is where it's pulling back too much. Thanks though.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What extraction do you currently have?

0 Karma

jeck11
Path Finder

I just updated the original post with screenshot. Do they help clarify the issue?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So have you tried the different suggestions for the regex string?

0 Karma

jeck11
Path Finder

I'm a moron. I just copied yours over and it worked. Thanks for sticking with me. I'll mark it as the answer.

0 Karma

rafadvega
Path Finder

Hi!

You can use this command:

index="index" search_term | rex field=_raw "LINK_TARGET\s:\s(?<link_target>[^\n]*)\n"

Tags (2)
0 Karma

jeck11
Path Finder

The search syntax that I included is working fine. I'm trying to define it as a field extraction and that's where it's pulling in too much. Thanks though.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...