Splunk Search

How do you extract a string from field _raw?

mukesh2019
Explorer

Hi ,

I am trying to extract info from the _raw result of my Splunk query. Currently my _raw result is:

_raw="ServiceOperation=Hudson_RetrivePatientNot|Broker_HostName=CHELSEA|RequestDateTime=20190113T03:02:18.209400|MessageTranID=**8bfa95c4170911e9b1740a099a2b0000**|UserID=A123|AppID=AERO|ExecGrpName=xxxxxx|TimeStamp=2019-01-13T03:02:28.364605|Message="RetrievePatientFailure"|Detail="RetreivePatientNotes""

I would like to extract the MessageTranID, which in this case is '8bfa95c4-1709-11e9-b174-0a099a2b0000', from the above _raw string.

Something like : base search | regex

Can anyone help?

Thanks so much!

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi mukesh2019,
try this regex:

\|MessageTranID\=(?<MessageTranID>[^\|]*)

You can test it at https://regex101.com/r/rsBith/1

Bye.
Giuseppe

View solution in original post

0 Karma

vnravikumar
Champion

Hi @mukesh2019

Please try this:

| rex field=_raw "MessageTranID\=(?P<MessageTranID>(.*))\|UserID\="

gcusello
SplunkTrust
SplunkTrust

Hi mukesh2019,
try this regex:

\|MessageTranID\=(?<MessageTranID>[^\|]*)

You can test it at https://regex101.com/r/rsBith/1

Bye.
Giuseppe

0 Karma

mukesh2019
Explorer

Thanks a lot.it works 🙂

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...