Splunk Search

How do you extract a string from field _raw?

mukesh2019
Explorer

Hi ,

I am trying to extract info from the _raw result of my Splunk query. Currently my _raw result is:

_raw="ServiceOperation=Hudson_RetrivePatientNot|Broker_HostName=CHELSEA|RequestDateTime=20190113T03:02:18.209400|MessageTranID=**8bfa95c4170911e9b1740a099a2b0000**|UserID=A123|AppID=AERO|ExecGrpName=xxxxxx|TimeStamp=2019-01-13T03:02:28.364605|Message="RetrievePatientFailure"|Detail="RetreivePatientNotes""

I would like to extract the MessageTranID, which in this case is '8bfa95c4-1709-11e9-b174-0a099a2b0000', from the above _raw string.

Something like : base search | regex

Can anyone help?

Thanks so much!

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi mukesh2019,
try this regex:

\|MessageTranID\=(?<MessageTranID>[^\|]*)

You can test it at https://regex101.com/r/rsBith/1

Bye.
Giuseppe

View solution in original post

0 Karma

vnravikumar
Champion

Hi @mukesh2019

Please try this:

| rex field=_raw "MessageTranID\=(?P<MessageTranID>(.*))\|UserID\="

gcusello
SplunkTrust
SplunkTrust

Hi mukesh2019,
try this regex:

\|MessageTranID\=(?<MessageTranID>[^\|]*)

You can test it at https://regex101.com/r/rsBith/1

Bye.
Giuseppe

0 Karma

mukesh2019
Explorer

Thanks a lot.it works :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...