How can I extract these highlighted fields?

[flora123]

Hi all
i want to get the below highlighted field.
"10.123.123.123","VM","??????????","VW_MCMM01_IvsHa","yellow","2016/12/27 04:49:16","False",,
"10.123.123.123","VM","???????????","nap1_SeneChrt","yellow","2016/12/26 16:59:20","False",,
"10.123.123.123","VM","???????????","VM_search-4-169_Gaw1Hijdas","yellow","2016/12/26 16:59:20","False",,

thanks a lot.

[gokadroid]

In the original set of examples you posted in question you seemed to be interested in catching a mixed bag. Wherein in some of them interested piece was after first underscore and in one of the example "VW_MCMM01_IvsHa" interested piece was after the second underscore i.e. IvsHa.

But based on recent comments If you want to capture everything after first underscore, try this:

your query to return events
|  rex "\"(?<ip>[^\"]+)\",\"(?<vm>[^\"]+)\",\"(?<question>[^\"]+)\",\"[^\_]+?\_(?<captured>[^\"]+)\""
| table captured

See extraction here

[niketn]

This seems to be a CSV file, is there a file header? Have you tried loading single file with Data Preview and sourcetype as csv?

---

EDITED with an approach to the solution.

---

If you add file as CSV sourcetype (rename as your own custom sourcetype name), fields should get automatically extracted. As per the details search time extracted field Entity should have the value you want to extract. Since your data is CSV format it would be better to define the sourcetype properly so that you do not need to spend additional time during field extraction/mapping. Also, while rex will do the job for you, you should ideally move the same to Field extraction Knowledge Object, for simplification and easy maintenance of Splunk searches.

Following is an example of using split command to split the Entity field into parts using underscore as the delimiter, mvcount is used to get the total split fields and finally mvindex to extract the last split field that contains the data you need.

<Your Base Search> 
| eval SplitFields=split(Entity,"_") 
| eval len=mvcount(SplitFields) 
| eval MyField=mvindex(SplitFields,len-1) 
| table Entity SplitFields len MyField

You can also apply rex on Entity field, however it would be better to move the field extraction to props.conf for the CSV sourcetype that you create.

Following is an example to test above code:

| makeresults 
| eval Entity="TACM_QA3_CharlesCheng" 
| eval SplitFields=split(Entity,"_") 
| eval len=mvcount(SplitFields) 
| eval MyField=mvindex(SplitFields,len-1) 
| table Entity SplitFields len MyField

[flora123]

yes,it's a CSV file.
the file header is:

TYPE Selected.System.String

"VC","EntityType","Alarm","Entity","Status","Time","Acknowledged","AckBy","AckTime"
i'll try load single file with Data Preview and sourcetype as csv.
thanks a lot.

[somesoni2 · Accepted solution]

Give this a try

your base search | rex "^(\"[^\"]+\",){3}\"([^_]+_){1,2}(?<error>\w+)\""

[flora123]

great!thanks a lot

[inventsekar]

please check this rex..

your search | rex field=_raw "\_(?<vmRex>\w+)\"" | table vmRex _raw

as shown on this pic, its picking two texts, but one text contains extra words(the underscore was not proper i think). it may work properly on your system. please check it..

[flora123]

Thanks a lot.
but i still get some error values, like the below highlighted field.
"10.123.123.123","VM","??????????","CM_NMCMSNM01_IvanHuang","yellow","2016/12/27 08:39:59","False",,
"10.123.123.123","VM","??????????","TACM_QA3_CharlesCheng","yellow","2016/12/21 07:01:20","False",,
"10.123.123.123","VM","GuestOS Shutdown or PowerOff","LucentNT_01_KaihongGuo","red","2016/11/30 02:09:07","False",,
"10.123.123.123","VM","GuestOS Shutdown or PowerOff","GISDEV_AP1_CasparChou","red","2016/12/19 09:54:35","False",,