Splunk Search

Help to extract fields from the URL

maria_n
Explorer

I need to extract "internal-blue-ocf" as namespace and "stress-b.aps.gc1-b.lle.ocf.xxx.com" as service using rex from the below data.
The condition for the fields should be like,
1) namespace: content between http:// and -oic
2) service: content should start after oic- and ends at .com

MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/

The rex should be used on field called MESSAGE. Please help!

0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE "Endpoint=http:\/\/(?P<namespace>.+)-oic-(?P<service>.+.com)"

View solution in original post

maria_n
Explorer

Thanks @vnravikumar and @kamlesh_vaghela. It worked 🙂

0 Karma

kartm2020
Communicator

Please try the below
| rex field=_raw "http:..(?P\w+-\w+-\w+)-oic-(?P.*.com)"

If the data look likes above, this regex will work. But the data contains numbers in between word. We need to write different regex.
Kindly let me know if it works.

0 Karma

maria_n
Explorer

Sorry, this didn't work @kartm. The above ones shared by kamlesh and ravikumar worked for me. Thanks anyway 🙂

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@maria_n

Can you please try this?

YOUR_SEARCH | rex field=MESSAGE " Endpoint=http:\/\/(?<namespace>.*)-oic-(?<service>.*\.com)" 
| table namespace service MESSAGE

Sample:

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE " Endpoint=http:\/\/(?<namespace>.*)-oic-(?<service>.*\.com)" 
| table namespace service MESSAGE

Thanks

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE "Endpoint=http:\/\/(?P<namespace>.+)-oic-(?P<service>.+.com)"
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...