Splunk Search

How to apply a regular expression that pulls multiple values from application log and show them to the given field name

iqbalintouch
Path Finder

Hi all,

I've been struggling to extract certain values from application logs and assign them to the given field name. As I don't know how to use or write regular expression in splunk, I need help to write a query to get the desired output. Here is my base search query:

https://www.myapplication.com/myapi/version5/autofill/ "ERROR"

here is the output log:

"ERROR" "store.view.app.api.controller.myClientLoggingController" "viewhost02" "myview2_2" <> "catalina-exec-7" "requestId=d4s6666-9d6e-2c0g-7c20-6e9f7wfa7f6" <> "clientIp=234.234.234.22" "store.view.app.api.controller.myClientLoggingController.logError(?:?):My-AngularApp
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxcxxxxxxxxxxxx

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

NOTE: in above log I have replaced the brackets <> with quotes ""

Now I want to extract the "requestId", "clientIp" and "My-AngularApp" and assign them to field name as "Req_ID", "Cust_IP" and "App_Name" respectively.

Can someone please help with the query to achieve the desired output, as I always struggle with REX syntax and can't write the query by my own.

Thank you in advance.

Labels (2)
0 Karma

Yorokobi
SplunkTrust
SplunkTrust

Here's a stab at it. You'll be better served by not substituting elements of your log except to obfuscate sensitive data. I worked with what you have, which means it may not work as-is but this should give you a pattern to follow.

<(?<log_level>[^>]+)>\s+<(?<class>[^>]+)>\s+<(?<hostname>[^>]+)>\s+<(?<viewname>[^>]+)>\s+<(?<unknown1>[^>].)?>\s+<(?<exec_process>[^>]+)>\s+<requestId=(?<Req_ID>[^>]+)>\s+<(?<unknown2>[^>]+)?>\s+<clientIp=(?<Cust_IP>[^\"]+)\">\"(?<log_class>[^:].+):(?<App_Name>[^\ ]+)

Regex101 link: https://regex101.com/r/FX8lkQ/1

richgalloway
SplunkTrust
SplunkTrust

I restored the angle brackets to make it easier for helpers to create a regex for you.  Please edit the question to correct any mistakes I may have made.

Are you familiar with regex101.com?  It's a great web site for testing regular expressions.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...