Splunk Search

How do you extract data from the following field event_message: "P5_Transfer,CLO,2018-08-08 12:12:57,Cardston transfer custom start point."

Engager

The following field after event_message is event_parameters:Film Configuration: {0} Name: {1} DateTime: {2} Note: {3} ,and it has the structure of the previous.

Thank you,

MIguel

0 Karma
1 Solution

Contributor
(?<Name>^\w+\,\w+)\,(?P<date_time>\d{1,4}\-\d{1,2}\-\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2})\,(?P<node>[a-zA-Z0-9_ ]*$)

View solution in original post

Contributor
(?<Name>^\w+\,\w+)\,(?P<date_time>\d{1,4}\-\d{1,2}\-\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2})\,(?P<node>[a-zA-Z0-9_ ]*$)

View solution in original post

Contributor

Then you can write another regex on Name to separate names or use splunk makemv delim="," Name kind of command set.

0 Karma

Engager

Thank you, it worked separating the data in between commas.

0 Karma

SplunkTrust
SplunkTrust

@aragoma, if it works for you, kindly accept the answer

0 Karma

Revered Legend

Could you provide more samples of raw data in the question and highlight which values you want to extract and name(s) of those fields?

0 Karma

Engager

event_message
P5_Sequential,Randall,2018-08-07 13:30:36,custom
P5_Transfer,CLO,2018-08-08 12:12:57,Cardston transfer custom start point
P5_Concurrent,Bryan Johnston,2018-08-26 16:51:58,Fluorescent lights have a 5 second delay before turning off. ove SCENE2 to 5 seconds earlier.
D5_Sequential,Jeff,2018-09-24 09:58:37,Stars w SD at 8:48

The data is separated by comas.

event_parameters
Film Configuration: {0} Name: {1} DateTime: {2} Note: {3}
these correspond to the data in the event_message.

For example
Film Configuration: {0} Name: {1} DateTime: {2} Note: {3}
D5_Sequential, Jeff, 2018-09-24 09:58:37, Stars w SD at 8:48

Miguel

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!