Splunk Search

Help to extract fields from the URL

Explorer

I need to extract "internal-blue-ocf" as namespace and "stress-b.aps.gc1-b.lle.ocf.xxx.com" as service using rex from the below data.
The condition for the fields should be like,
1) namespace: content between http:// and -oic
2) service: content should start after oic- and ends at .com

MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/

The rex should be used on field called MESSAGE. Please help!

0 Karma
1 Solution

Champion

Hi

Try this

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE "Endpoint=http:\/\/(?P<namespace>.+)-oic-(?P<service>.+.com)"

View solution in original post

Explorer

Thanks @vnravikumar and @kamlesh_vaghela. It worked 🙂

0 Karma

Communicator

Please try the below
| rex field=_raw "http:..(?P\w+-\w+-\w+)-oic-(?P.*.com)"

If the data look likes above, this regex will work. But the data contains numbers in between word. We need to write different regex.
Kindly let me know if it works.

0 Karma

Explorer

Sorry, this didn't work @kartm. The above ones shared by kamlesh and ravikumar worked for me. Thanks anyway 🙂

0 Karma

SplunkTrust
SplunkTrust

@maria_n

Can you please try this?

YOUR_SEARCH | rex field=MESSAGE " Endpoint=http:\/\/(?<namespace>.*)-oic-(?<service>.*\.com)" 
| table namespace service MESSAGE

Sample:

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE " Endpoint=http:\/\/(?<namespace>.*)-oic-(?<service>.*\.com)" 
| table namespace service MESSAGE

Thanks

Champion

Hi

Try this

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE "Endpoint=http:\/\/(?P<namespace>.+)-oic-(?P<service>.+.com)"

View solution in original post