Splunk Search

How do you extract data from the following field event_message: "P5_Transfer,CLO,2018-08-08 12:12:57,Cardston transfer custom start point."

aragoma
Engager

The following field after event_message is event_parameters:Film Configuration: {0} Name: {1} DateTime: {2} Note: {3} ,and it has the structure of the previous.

Thank you,

MIguel

0 Karma
1 Solution

macadminrohit
Contributor
(?<Name>^\w+\,\w+)\,(?P<date_time>\d{1,4}\-\d{1,2}\-\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2})\,(?P<node>[a-zA-Z0-9_ ]*$)

View solution in original post

macadminrohit
Contributor
(?<Name>^\w+\,\w+)\,(?P<date_time>\d{1,4}\-\d{1,2}\-\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2})\,(?P<node>[a-zA-Z0-9_ ]*$)

macadminrohit
Contributor

Then you can write another regex on Name to separate names or use splunk makemv delim="," Name kind of command set.

0 Karma

aragoma
Engager

Thank you, it worked separating the data in between commas.

0 Karma

adonio
Ultra Champion

@aragoma, if it works for you, kindly accept the answer

0 Karma

somesoni2
Revered Legend

Could you provide more samples of raw data in the question and highlight which values you want to extract and name(s) of those fields?

0 Karma

aragoma
Engager

event_message
P5_Sequential,Randall,2018-08-07 13:30:36,custom
P5_Transfer,CLO,2018-08-08 12:12:57,Cardston transfer custom start point
P5_Concurrent,Bryan Johnston,2018-08-26 16:51:58,Fluorescent lights have a 5 second delay before turning off. ove SCENE2 to 5 seconds earlier.
D5_Sequential,Jeff,2018-09-24 09:58:37,Stars w SD at 8:48

The data is separated by comas.

event_parameters
Film Configuration: {0} Name: {1} DateTime: {2} Note: {3}
these correspond to the data in the event_message.

For example
Film Configuration: {0} Name: {1} DateTime: {2} Note: {3}
D5_Sequential, Jeff, 2018-09-24 09:58:37, Stars w SD at 8:48

Miguel

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...