Field extraction using rex

[avanijjain16]

Hi,

I am new to splunk, I am trying to extract specific message from my log event. The pattern I am looking from below message 

[ERROR] 2020-09-28T11:50:06.108Z           6012c275-5df5-4839-95a0-260057509041     |HLX|Task Failure Occured:{'jobid': 'FLOW-134', 'taskid': 'T-09', 'subtaskid': 'a88f6260-0180-11eb-9ccc-3e5cb494596a'}

I need to extract everything after |HLX| and create another field. Its fine even if it includes |HLX|. I have tried multiple patterns but none are working. Any help would be appreciated. 

Thank you.

[inventsekar · Accepted solution]

Hi @avanijjain16 ... i created a log event with your sample log and ran the rex from @493669 , it works fine.  you just have to use the field namev (if ur field name is _raw, simply run "|rex field=_raw.. ") and ".+" or ".*" - both are same. 

| makeresults 
| eval log="[ERROR] 2020-09-28T11:50:06.108Z 6012c275-5df5-4839-95a0-260057509041 |HLX|Task Failure Occured:{'jobid': 'FLOW-134', 'taskid': 'T-09', 'subtaskid': 'a88f6260-0180-11eb-9ccc-3e5cb494596a'}" 
| rex field=log "HLX\|(?<TaskStatus>.*)" 
| table TaskStatus

 

[avanijjain16]

So I did some search and found that it’s pre-pattern and then (? Creates new field name TaskStatus that follows HLX and matching with pattern .* (basically everything except /n) . I have some logs where there is chance of \n coming in. It would not match in those cases. Any idea how to allow that. \n can appear any where followed by HLX.

"HLX\|(?<TaskStatus>.*)" 

[493669]

@avanijjain16 

Can you try below regex-

|rex "HLX\|(?<fieldname>.+)"