Splunk Search

How to achieve field extraction txt delimiting by space?

user33
Path Finder

Hello,

I am trying to extract the below 201 text highlighted in red below as one separate field from two separate events. How may I do this? I attempted the field extraction feature in Splunk but had no luck. Any assistance is appreciated!

Event 1:
106.51.86.25 [22/Dec/2022:07:48:10 -0500] POST /services/public/v1/signup HTTP/1.1 201 5 539
 
Event 2:
23.197.194.86 - - [22/Dec/2022:07:48:09 -0500] "POST /services/public/v1/signup HTTP/1.1" 201 -
Labels (3)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

I didn't notice that the logs in Event 1 is not fully conformant to NCSA.  This is horrible and you should get the developers/admins to fix that.  In the short term, if HTTP status is the only field of interest, you can try

| rex "(GET|POST|HEAD|DELETE) +\S+ +HTTP/\S+\s+(?<http_status>\d+)"

Here I'm trying to make this as robust as possible according to the posted patterns and some educated guesses.  But given that your developers are not respecting a well-established  format, there's no guarantee that they'll follow this pattern in all cases.

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

This is NCSA's httpd access log format which Splunk provides a stock extraction.  Just set sourcetype to "access_combined" or "access_common".  This will give you the best result.  You can study related stanzas in  etc/system/default/props.conf to see how it is done.

0 Karma

user33
Path Finder

Thank you. I can look into that. Is there a short-term solution I can do in the interim? 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I didn't notice that the logs in Event 1 is not fully conformant to NCSA.  This is horrible and you should get the developers/admins to fix that.  In the short term, if HTTP status is the only field of interest, you can try

| rex "(GET|POST|HEAD|DELETE) +\S+ +HTTP/\S+\s+(?<http_status>\d+)"

Here I'm trying to make this as robust as possible according to the posted patterns and some educated guesses.  But given that your developers are not respecting a well-established  format, there's no guarantee that they'll follow this pattern in all cases.

0 Karma

user33
Path Finder

That definitely works for the time being. Thank you very much!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...