Splunk Search

How to apply a regular expression that pulls multiple values from application log and show them to the given field name

iqbalintouch
Path Finder

Hi all,

I've been struggling to extract certain values from application logs and assign them to the given field name. As I don't know how to use or write regular expression in splunk, I need help to write a query to get the desired output. Here is my base search query:

https://www.myapplication.com/myapi/version5/autofill/ "ERROR"

here is the output log:

"ERROR" "store.view.app.api.controller.myClientLoggingController" "viewhost02" "myview2_2" <> "catalina-exec-7" "requestId=d4s6666-9d6e-2c0g-7c20-6e9f7wfa7f6" <> "clientIp=234.234.234.22" "store.view.app.api.controller.myClientLoggingController.logError(?:?):My-AngularApp
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxcxxxxxxxxxxxx

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

NOTE: in above log I have replaced the brackets <> with quotes ""

Now I want to extract the "requestId", "clientIp" and "My-AngularApp" and assign them to field name as "Req_ID", "Cust_IP" and "App_Name" respectively.

Can someone please help with the query to achieve the desired output, as I always struggle with REX syntax and can't write the query by my own.

Thank you in advance.

Labels (2)
0 Karma

Yorokobi
SplunkTrust
SplunkTrust

Here's a stab at it. You'll be better served by not substituting elements of your log except to obfuscate sensitive data. I worked with what you have, which means it may not work as-is but this should give you a pattern to follow.

<(?<log_level>[^>]+)>\s+<(?<class>[^>]+)>\s+<(?<hostname>[^>]+)>\s+<(?<viewname>[^>]+)>\s+<(?<unknown1>[^>].)?>\s+<(?<exec_process>[^>]+)>\s+<requestId=(?<Req_ID>[^>]+)>\s+<(?<unknown2>[^>]+)?>\s+<clientIp=(?<Cust_IP>[^\"]+)\">\"(?<log_class>[^:].+):(?<App_Name>[^\ ]+)

Regex101 link: https://regex101.com/r/FX8lkQ/1

richgalloway
SplunkTrust
SplunkTrust

I restored the angle brackets to make it easier for helpers to create a regex for you.  Please edit the question to correct any mistakes I may have made.

Are you familiar with regex101.com?  It's a great web site for testing regular expressions.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...