Splunk Search

How can I extract these highlighted fields?

flora123
Path Finder

Hi all
i want to get the below highlighted field.
"10.123.123.123","VM","??????????","VW_MCMM01_IvsHa","yellow","2016/12/27 04:49:16","False",,
"10.123.123.123","VM","???????????","nap1_SeneChrt","yellow","2016/12/26 16:59:20","False",,
"10.123.123.123","VM","???????????","VM_search-4-169_Gaw1Hijdas","yellow","2016/12/26 16:59:20","False",,

thanks a lot.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your base search | rex "^(\"[^\"]+\",){3}\"([^_]+_){1,2}(?<error>\w+)\""

View solution in original post

0 Karma

gokadroid
Motivator

In the original set of examples you posted in question you seemed to be interested in catching a mixed bag. Wherein in some of them interested piece was after first underscore and in one of the example "VW_MCMM01_IvsHa" interested piece was after the second underscore i.e. IvsHa.

But based on recent comments If you want to capture everything after first underscore, try this:

your query to return events
|  rex "\"(?<ip>[^\"]+)\",\"(?<vm>[^\"]+)\",\"(?<question>[^\"]+)\",\"[^\_]+?\_(?<captured>[^\"]+)\""
| table captured

See extraction here

0 Karma

niketn
Legend

This seems to be a CSV file, is there a file header? Have you tried loading single file with Data Preview and sourcetype as csv?


EDITED with an approach to the solution.


If you add file as CSV sourcetype (rename as your own custom sourcetype name), fields should get automatically extracted. As per the details search time extracted field Entity should have the value you want to extract. Since your data is CSV format it would be better to define the sourcetype properly so that you do not need to spend additional time during field extraction/mapping. Also, while rex will do the job for you, you should ideally move the same to Field extraction Knowledge Object, for simplification and easy maintenance of Splunk searches.

Following is an example of using split command to split the Entity field into parts using underscore as the delimiter, mvcount is used to get the total split fields and finally mvindex to extract the last split field that contains the data you need.

<Your Base Search> 
| eval SplitFields=split(Entity,"_") 
| eval len=mvcount(SplitFields) 
| eval MyField=mvindex(SplitFields,len-1) 
| table Entity SplitFields len MyField

You can also apply rex on Entity field, however it would be better to move the field extraction to props.conf for the CSV sourcetype that you create.

Following is an example to test above code:

| makeresults 
| eval Entity="TACM_QA3_CharlesCheng" 
| eval SplitFields=split(Entity,"_") 
| eval len=mvcount(SplitFields) 
| eval MyField=mvindex(SplitFields,len-1) 
| table Entity SplitFields len MyField
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

flora123
Path Finder

yes,it's a CSV file.
the file header is:

TYPE Selected.System.String

"VC","EntityType","Alarm","Entity","Status","Time","Acknowledged","AckBy","AckTime"
i'll try load single file with Data Preview and sourcetype as csv.
thanks a lot.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your base search | rex "^(\"[^\"]+\",){3}\"([^_]+_){1,2}(?<error>\w+)\""
0 Karma

flora123
Path Finder

great!thanks a lot

0 Karma

inventsekar
Ultra Champion

please check this rex..

your search | rex field=_raw "\_(?<vmRex>\w+)\"" | table vmRex _raw

alt text
as shown on this pic, its picking two texts, but one text contains extra words(the underscore was not proper i think). it may work properly on your system. please check it..

0 Karma

flora123
Path Finder

Thanks a lot.
but i still get some error values, like the below highlighted field.
"10.123.123.123","VM","??????????","CM_NMCMSNM01_IvanHuang","yellow","2016/12/27 08:39:59","False",,
"10.123.123.123","VM","??????????","TACM_QA3_CharlesCheng","yellow","2016/12/21 07:01:20","False",,
"10.123.123.123","VM","GuestOS Shutdown or PowerOff","LucentNT_01_KaihongGuo","red","2016/11/30 02:09:07","False",,
"10.123.123.123","VM","GuestOS Shutdown or PowerOff","GISDEV_AP1_CasparChou","red","2016/12/19 09:54:35","False",,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...