Splunk Search

How do I extract a field from another field?

rohinisb91
Observer

I have an event in the following format

2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO  com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC

These are already part of the "message" field. How do I extract npid, groupId, dom, source as different fields? These should be extracted as fields going forward.

Any pointers are appreciated!

Tags (2)
0 Karma

saurabhkharkar
Path Finder
| makeresults 
| eval message="2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO  com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC"
|rex field=message ".*Bolt\=(?<Bolt>[^\|]+)"
|rex field=message ".*source\=(?<source>[^\|]+)" 
|rex field=message ".*dom\=(?<dom>[^\|]+)" 
|rex field=message ".*groupId\=(?<groupId>[^\|]+)" 
|rex field=message ".*npid\=(?<npid>[^\|]+)" 
|table message Bolt source dom groupId npid
0 Karma

adonio
Ultra Champion

hello there:

runt this search anywhere:

| makeresults count=1
| eval _raw = "2018-12-10 15:15:40 [Thread-34-TestBolt-executor[4 4]] INFO  com.learn.code.StringQ.execute:67 - Bolt=StringQBolt | source=XYZ | dom=xyz| groupId=21239 | npid=ABC"
| rex field=_raw "(?<time>\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2})\s+\[(?<something>[^\[]+)\[(?<some_digits>[^\]]+)\]\]\s+(?<log_level>[^\s]+)\s+(?<some_fqdn_maybe>[^\:]+)\:(?<maybe_port>\d+)\s\-\s(?<everything_elde>.+)"
| extract pairdelim="|", kvdelim="=:"

to make it permanent use props.conf
you can also use the interactive field extractor

hope it helps

ddrillic
Ultra Champion

Something in the spirit of .*source=(?<source>\w*).*dom=(?<dom>\w*)...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...