Splunk Search

How could extract a new field from a sentence which contains the expression of the value?

Jennifer
Path Finder

Hi, all!

Here's my log file:

- the pattern: raw call progress sequence is: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

- the length of the value of the raw call progress sequence might differ from each other

My request is how could I extract the highlighted part as a new filed!!!

2022-02-07 16:27:49,423|tOX-u3JFAq6EmU3FXYy-Td2|DEBUG|com.hsbc.hvf.mi.MIAPI|endCallMI()|MI insertion started... 2022-02-07 16:27:49,423|tOX-u3JFAq6EmU3FXYy-Td2|DEBUG|com.hsbc.hvf.mi.MIAPI|endCallMI()|raw call progress sequence is:31381113209410021947204792292008771577067705W019W021W023W02099529959 

raw call progress sequence is:31381116209410122047922920012099215396732101210296887903763575957598W016E194Q098U165W023A024995299563173

raw call progress sequence is:313811112094100231941577

raw call progress sequence is:313811162094100219472047922920012099215396732101210296889296961877197902790876367637W016E191Q064U086W023A70299529956653765386604W016CS00E191Q064U086W023A7029952995665376538

 

Labels (2)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust
raw\scall\sprogress\ssequence\sis:\s(?<progress_sequence>\S+)

I'm not fully sure from your examples whether there should be \s or not between : and (

View solution in original post

PickleRick
SplunkTrust
SplunkTrust
raw\scall\sprogress\ssequence\sis:\s(?<progress_sequence>\S+)

I'm not fully sure from your examples whether there should be \s or not between : and (

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...