Splunk Search

Field extraction for logs with slightly different field position based on the servername

splunk_worker
Path Finder

Hi All
Here are my sample logs

_time prod-server-1234 web_access 10.11.12.13 "GET /json/some_search?asasa HTTP/1.1" 200 189 "-" "AppEngine-Google; ( some-search-engine; appid: a12334445)" 0.221 "-/-" mydomain

_time test-server-1234 web_access 33.44.55.66 (10.66.77.88) "GET /json/some_search?sdsddd HTTP/1.1" 200 189 "-" "AppEngine-Google; ( some-search-engine; appid: a12334445)" 0.221 "-/-" mydomain

In the 1st event, the server name is prod-server-1234 and the client ip is 10.11.12.13

In the 2nd event the server name is test-server-1234 and the client ip is 10.66.77.88 and destination ip is 33.44.55.66. The destination ip in the 2nd log and client ip in the 1st log are same position.

Note that, event2 has client ip within bracket and the ip after web_access is destination ip.

So, the extraction should be different for server name starts with prod-server-* to extract client ip. The extraction for server names starts with test-server-* should be different for extracting destination ip and client ip.

Note that, the client ip location is different in both formats of the logs. Both logs are same type and coming from same source / log file.

What do I differentiate both server names and extract?

servername format is always fixed.

Tags (2)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi splunk_worker,

base on your two log examples you can use something like this on your events to get new fields named servername, destIP and clientIP:

your base search to get the events 
| rex field=_raw "\s(?<servername>(prod-server-)\d+|(test-server-)\d+)\s"
| rex field=_raw "web_access\s(?<destIP>(\d+\.){3}\d+)(?=\s\()"
| rex field=_raw "(?<clientIP>(\d+\.){3}\d+)(?=[)\s]+\"GET)"
| table servername destIP clientIP

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi splunk_worker,

base on your two log examples you can use something like this on your events to get new fields named servername, destIP and clientIP:

your base search to get the events 
| rex field=_raw "\s(?<servername>(prod-server-)\d+|(test-server-)\d+)\s"
| rex field=_raw "web_access\s(?<destIP>(\d+\.){3}\d+)(?=\s\()"
| rex field=_raw "(?<clientIP>(\d+\.){3}\d+)(?=[)\s]+\"GET)"
| table servername destIP clientIP

hope this helps ...

cheers, MuS

splunk_worker
Path Finder

Thanks a lot. Got it what I wanted.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...