Splunk Search

How to apply a regular expression that pulls multiple values from application log and show them to the given field name

Path Finder

Hi all,

I've been struggling to extract certain values from application logs and assign them to the given field name. As I don't know how to use or write regular expression in splunk, I need help to write a query to get the desired output. Here is my base search query:

https://www.myapplication.com/myapi/version5/autofill/ "ERROR"

here is the output log:

"ERROR" "store.view.app.api.controller.myClientLoggingController" "viewhost02" "myview2_2" <> "catalina-exec-7" "requestId=d4s6666-9d6e-2c0g-7c20-6e9f7wfa7f6" <> "clientIp=" "store.view.app.api.controller.myClientLoggingController.logError(?:?):My-AngularApp


NOTE: in above log I have replaced the brackets <> with quotes ""

Now I want to extract the "requestId", "clientIp" and "My-AngularApp" and assign them to field name as "Req_ID", "Cust_IP" and "App_Name" respectively.

Can someone please help with the query to achieve the desired output, as I always struggle with REX syntax and can't write the query by my own.

Thank you in advance.

Labels (2)
0 Karma


Here's a stab at it. You'll be better served by not substituting elements of your log except to obfuscate sensitive data. I worked with what you have, which means it may not work as-is but this should give you a pattern to follow.

<(?<log_level>[^>]+)>\s+<(?<class>[^>]+)>\s+<(?<hostname>[^>]+)>\s+<(?<viewname>[^>]+)>\s+<(?<unknown1>[^>].)?>\s+<(?<exec_process>[^>]+)>\s+<requestId=(?<Req_ID>[^>]+)>\s+<(?<unknown2>[^>]+)?>\s+<clientIp=(?<Cust_IP>[^\"]+)\">\"(?<log_class>[^:].+):(?<App_Name>[^\ ]+)

Regex101 link: https://regex101.com/r/FX8lkQ/1


I restored the angle brackets to make it easier for helpers to create a regex for you.  Please edit the question to correct any mistakes I may have made.

Are you familiar with regex101.com?  It's a great web site for testing regular expressions.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...