Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Having trouble with field extractor on 7.0
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have ton a couple of events like this:
Mime.stuff.1 = 10
Mime.pop = "blabla"
Basically I want to create a field "MimeProperty" and the require is to begin with a "Mime.". I'm having trouble working with the extractor as I don't fully understand it. Can anyone point me in the right direction ? Thanks in advance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this :
index=your_index | rex field=_raw "Mime.*\=\s(|\")(?P<MimeProperty>[^\s|\"]+)"
Let me know if it helps!!
If you get improper output then pls provide some sample events. like there is a confusion of space after "="
in every event.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this :
index=your_index | rex field=_raw "Mime.*\=\s(|\")(?P<MimeProperty>[^\s|\"]+)"
Let me know if it helps!!
If you get improper output then pls provide some sample events. like there is a confusion of space after "="
in every event.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@mayurr98 Nice it works plenty! Post as an answer for me to mark it as correct
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You are welcome,
i have converted Please accept!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can you please elaborate on more sample events?
also what do you want to extract? 10 and blabla?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Those would be the values yes. I wan't every field that's starts off with Mime
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
