Splunk Search
Highlighted

How can I extract these highlighted fields?

Path Finder

Hi all
i want to get the below highlighted field.
"10.123.123.123","VM","??????????","VWMCMM01IvsHa","yellow","2016/12/27 04:49:16","False",,
"10.123.123.123","VM","???????????","nap1SeneChrt","yellow","2016/12/26 16:59:20","False",,
"10.123.123.123","VM","???????????","VM
search-4-169_Gaw1Hijdas","yellow","2016/12/26 16:59:20","False",,

thanks a lot.

0 Karma
Highlighted

Re: How can I extract these highlighted fields?

Champion

please check this rex..

your search | rex field=_raw "\_(?<vmRex>\w+)\"" | table vmRex _raw

alt text
as shown on this pic, its picking two texts, but one text contains extra words(the underscore was not proper i think). it may work properly on your system. please check it..

0 Karma
Highlighted

Re: How can I extract these highlighted fields?

Path Finder

Thanks a lot.
but i still get some error values, like the below highlighted field.
"10.123.123.123","VM","??????????","CM**NMCMSNM01IvanHuang","yellow","2016/12/27 08:39:59","False",,
"10.123.123.123","VM","??????????","TACM_
QA3CharlesCheng**","yellow","2016/12/21 07:01:20","False",,
"10.123.123.123","VM","GuestOS Shutdown or PowerOff","LucentNT
01_KaihongGuo","red","2016/11/30 02:09:07","False",,
"10.123.123.123","VM","GuestOS Shutdown or PowerOff","GISDEV**AP1CasparChou**","red","2016/12/19 09:54:35","False",,

0 Karma
Highlighted

Re: How can I extract these highlighted fields?

SplunkTrust
SplunkTrust

Give this a try

your base search | rex "^(\"[^\"]+\",){3}\"([^_]+_){1,2}(?<error>\w+)\""

View solution in original post

0 Karma
Highlighted

Re: How can I extract these highlighted fields?

Path Finder

great!thanks a lot

0 Karma
Highlighted

Re: How can I extract these highlighted fields?

Legend

This seems to be a CSV file, is there a file header? Have you tried loading single file with Data Preview and sourcetype as csv?


EDITED with an approach to the solution.


If you add file as CSV sourcetype (rename as your own custom sourcetype name), fields should get automatically extracted. As per the details search time extracted field Entity should have the value you want to extract. Since your data is CSV format it would be better to define the sourcetype properly so that you do not need to spend additional time during field extraction/mapping. Also, while rex will do the job for you, you should ideally move the same to Field extraction Knowledge Object, for simplification and easy maintenance of Splunk searches.

Following is an example of using split command to split the Entity field into parts using underscore as the delimiter, mvcount is used to get the total split fields and finally mvindex to extract the last split field that contains the data you need.

<Your Base Search> 
| eval SplitFields=split(Entity,"_") 
| eval len=mvcount(SplitFields) 
| eval MyField=mvindex(SplitFields,len-1) 
| table Entity SplitFields len MyField

You can also apply rex on Entity field, however it would be better to move the field extraction to props.conf for the CSV sourcetype that you create.

Following is an example to test above code:

| makeresults 
| eval Entity="TACM_QA3_CharlesCheng" 
| eval SplitFields=split(Entity,"_") 
| eval len=mvcount(SplitFields) 
| eval MyField=mvindex(SplitFields,len-1) 
| table Entity SplitFields len MyField



| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: How can I extract these highlighted fields?

Path Finder

yes,it's a CSV file.
the file header is:

TYPE Selected.System.String

"VC","EntityType","Alarm","Entity","Status","Time","Acknowledged","AckBy","AckTime"
i'll try load single file with Data Preview and sourcetype as csv.
thanks a lot.

0 Karma
Highlighted

Re: How can I extract these highlighted fields?

Motivator

In the original set of examples you posted in question you seemed to be interested in catching a mixed bag. Wherein in some of them interested piece was after first underscore and in one of the example "VW_MCMM01_IvsHa" interested piece was after the second underscore i.e. IvsHa.

But based on recent comments If you want to capture everything after first underscore, try this:

your query to return events
|  rex "\"(?<ip>[^\"]+)\",\"(?<vm>[^\"]+)\",\"(?<question>[^\"]+)\",\"[^\_]+?\_(?<captured>[^\"]+)\""
| table captured

See extraction here

0 Karma