Splunk Search

How do you extract a string from field _raw?

mukesh2019
Explorer

Hi ,

I am trying to extract info from the _raw result of my Splunk query. Currently my _raw result is:

_raw="ServiceOperation=Hudson_RetrivePatientNot|Broker_HostName=CHELSEA|RequestDateTime=20190113T03:02:18.209400|MessageTranID=**8bfa95c4170911e9b1740a099a2b0000**|UserID=A123|AppID=AERO|ExecGrpName=xxxxxx|TimeStamp=2019-01-13T03:02:28.364605|Message="RetrievePatientFailure"|Detail="RetreivePatientNotes""

I would like to extract the MessageTranID, which in this case is '8bfa95c4-1709-11e9-b174-0a099a2b0000', from the above _raw string.

Something like : base search | regex

Can anyone help?

Thanks so much!

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi mukesh2019,
try this regex:

\|MessageTranID\=(?<MessageTranID>[^\|]*)

You can test it at https://regex101.com/r/rsBith/1

Bye.
Giuseppe

View solution in original post

0 Karma

vnravikumar
Champion

Hi @mukesh2019

Please try this:

| rex field=_raw "MessageTranID\=(?P<MessageTranID>(.*))\|UserID\="

gcusello
SplunkTrust
SplunkTrust

Hi mukesh2019,
try this regex:

\|MessageTranID\=(?<MessageTranID>[^\|]*)

You can test it at https://regex101.com/r/rsBith/1

Bye.
Giuseppe

0 Karma

mukesh2019
Explorer

Thanks a lot.it works 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...