Splunk Search

Field-Extraction

Motivator

I have a some data I am attempting to extract and then do lookups on. I am attempting to extract the FID number, which is effectivley - "FID":FID#:property = < value >

Take a look at my entry:

FID:1022:5=18749,109 FID:1025:5=18752,109 FID:1029:8=0:0:0 FID:1066:5=0,101 FID:1179:1=1 FID:2000:2=1 FID:3001:6=  FID:6335:6=US4592001014 FID:6360:6=2005973 FID:6605:1=1.01755e+013 FID:6630:1=8.26677e-005 FID:7012:6=459200101 FID:8107:1=0 FID:17476:2=0 FID:17483:2=-1 FID:20001:6=ADdomain FID:20003:6=domain1 FID:20008:6=user1 FID:20052:6=DEP01 

I attempted to use this REGEX extraction, but splunk doesn't recognize it: FID:(?<FID>\d+):\d+

I'm guess that either RegEx changed, or splunk changed somehow and I missed it, or i'm fat fingering something?

Thank you!

Tags (2)
1 Solution

Revered Legend

This works for me (give a multivalued field will all FID#)

Your base search | rex max_match=0 "FID:(?<FID>\d+):\d+="

View solution in original post

Revered Legend

This works for me (give a multivalued field will all FID#)

Your base search | rex max_match=0 "FID:(?<FID>\d+):\d+="

View solution in original post

Motivator

Thank you!!

0 Karma

Revered Legend

Motivator

Thank you!!! This works very well! is there a way to do this in props.conf or transforms?

0 Karma

Motivator

Let's take the first part of the log entry:

FID:1022:5=18749

In this example, the number "1022" is what i'm looking to extract.

0 Karma

SplunkTrust
SplunkTrust

So you want to get the values 1022, 1025, 1029, etc?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Motivator

This is a snippet of one log entry, and I would need to extract ALL FID#'s from all log entries.

0 Karma

Revered Legend

This is one log entry or 4? In both case, you need to extract all FID#?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!