Splunk Search

Field extraction using rex

avanijjain16
Explorer

Hi,

 

I am new to splunk, I am trying to extract specific message from my log event. The pattern I am looking from below message 

[ERROR] 2020-09-28T11:50:06.108Z           6012c275-5df5-4839-95a0-260057509041     |HLX|Task Failure Occured:{'jobid': 'FLOW-134', 'taskid': 'T-09', 'subtaskid': 'a88f6260-0180-11eb-9ccc-3e5cb494596a'}

 

I need to extract everything after |HLX| and create another field. Its fine even if it includes |HLX|. I have tried multiple patterns but none are working. Any help would be appreciated. 

 

Thank you.

 

avanijjain16_0-1601311550636.png

 

Labels (5)
0 Karma
1 Solution

inventsekar
Ultra Champion

Hi @avanijjain16 ... i created a log event with your sample log and ran the rex from @493669 , it works fine.  you just have to use the field namev (if ur field name is _raw, simply run "|rex field=_raw.. ") and ".+" or ".*" - both are same. 

| makeresults 
| eval log="[ERROR] 2020-09-28T11:50:06.108Z 6012c275-5df5-4839-95a0-260057509041 |HLX|Task Failure Occured:{'jobid': 'FLOW-134', 'taskid': 'T-09', 'subtaskid': 'a88f6260-0180-11eb-9ccc-3e5cb494596a'}" 
| rex field=log "HLX\|(?<TaskStatus>.*)" 
| table TaskStatus

 simple.jpg

View solution in original post

inventsekar
Ultra Champion

Hi @avanijjain16 ... i created a log event with your sample log and ran the rex from @493669 , it works fine.  you just have to use the field namev (if ur field name is _raw, simply run "|rex field=_raw.. ") and ".+" or ".*" - both are same. 

| makeresults 
| eval log="[ERROR] 2020-09-28T11:50:06.108Z 6012c275-5df5-4839-95a0-260057509041 |HLX|Task Failure Occured:{'jobid': 'FLOW-134', 'taskid': 'T-09', 'subtaskid': 'a88f6260-0180-11eb-9ccc-3e5cb494596a'}" 
| rex field=log "HLX\|(?<TaskStatus>.*)" 
| table TaskStatus

 simple.jpg

avanijjain16
Explorer

So I did some search and found that it’s pre-pattern and then (? Creates new field name TaskStatus that follows HLX and matching with pattern .* (basically everything except /n) . I have some logs where there is chance of \n coming in. It would not match in those cases. Any idea how to allow that. \n can appear any where followed by HLX.

"HLX\|(?<TaskStatus>.*)" 

 

Tags (1)
0 Karma

493669
Super Champion

@avanijjain16 

Can you try below regex-

|rex "HLX\|(?<fieldname>.+)"

avanijjain16
Explorer
 
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...