Field extraction for logs with slightly different field position based on the servername

[splunk_worker]

Hi All
Here are my sample logs

_time prod-server-1234 web_access 10.11.12.13 "GET /json/some_search?asasa HTTP/1.1" 200 189 "-" "AppEngine-Google; ( some-search-engine; appid: a12334445)" 0.221 "-/-" mydomain

_time test-server-1234 web_access 33.44.55.66 (10.66.77.88) "GET /json/some_search?sdsddd HTTP/1.1" 200 189 "-" "AppEngine-Google; ( some-search-engine; appid: a12334445)" 0.221 "-/-" mydomain

In the 1st event, the server name is prod-server-1234 and the client ip is 10.11.12.13

In the 2nd event the server name is test-server-1234 and the client ip is 10.66.77.88 and destination ip is 33.44.55.66. The destination ip in the 2nd log and client ip in the 1st log are same position.

Note that, event2 has client ip within bracket and the ip after web_access is destination ip.

So, the extraction should be different for server name starts with prod-server-* to extract client ip. The extraction for server names starts with test-server-* should be different for extracting destination ip and client ip.

Note that, the client ip location is different in both formats of the logs. Both logs are same type and coming from same source / log file.

What do I differentiate both server names and extract?

servername format is always fixed.

[MuS · Accepted solution]

Hi splunk_worker,

base on your two log examples you can use something like this on your events to get new fields named servername, destIP and clientIP:

your base search to get the events 
| rex field=_raw "\s(?<servername>(prod-server-)\d+|(test-server-)\d+)\s"
| rex field=_raw "web_access\s(?<destIP>(\d+\.){3}\d+)(?=\s\()"
| rex field=_raw "(?<clientIP>(\d+\.){3}\d+)(?=[)\s]+\"GET)"
| table servername destIP clientIP

hope this helps ...

cheers, MuS

[splunk_worker]

Thanks a lot. Got it what I wanted.