Splunk Search

How can I extract the 3 or 5 digit number and 2 3-letter words after "Request" in my sample log?

kostasKats
Explorer

The log is:

2015-06-15 15:50:29,381 ws prd 62 WARN  JourneySearch # # # # Blocked Incoming Request 13360-PSA-LIS

I have used this for the 3/5 digit number, but I want know to extract the words after the number:

rex field=_raw " Blocked Incoming Request (?<aid>\d+)" 

Can someone help me please?

1 Solution

woodcock
Esteemed Legend

Like this:

rex field=_raw " Blocked Incoming Request (?<aid>d+)(?<theRest>.*)$"

View solution in original post

0 Karma

kostasKats
Explorer

Thank you very much all!

This worked perfect for my work:
"Blocked Incoming Request" |rex field=_raw "Request (?\d+)-(?\S+)" |stats count by aid, word

0 Karma

reed_kelly
Contributor

You can also get the words as a multi-valued result and separate them as needed with mvexpand

|rex field=_raw "Request (?<aid>\d+)\-(?<words>\S+)"  |makemv delim="-" words |mvexpand words

woodcock
Esteemed Legend

You also need max_match=0 like this:

|rex max_match=0 field=_raw "Request (?\d+)\-(?\S+)"  |makemv delim="-" words |mvexpand words
0 Karma

woodcock
Esteemed Legend

Like this:

rex field=_raw " Blocked Incoming Request (?<aid>d+)(?<theRest>.*)$"
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...