Splunk Search
Highlighted

How to create a regular expression for a field in a log file?

New Member

Hi, first of all thanks for help me.

I have this log file:

2016-11-21T16:29:25.690+0100 INFO    2867 com.l7tech.log.custom.csm: -4: SplunkService=LIVEpolicy_csmws_poas
... 20 lines omitted ...
                  <![CDATA[
                     <CategoryAvailabilityRequest>
    <SessionInfo>
        <SessionID>value</SessionID>
        <Profile>A</Profile>
        <Language>DEU</Language>
        <Version>1</Version>
    </SessionInfo>
    <BookingContext>
        <AgencyID>value</AgencyID>
        <BookingContactName>XML Test</BookingContactName>
        <MarketCode>value</MarketCode>
        <BookingCurrencyCode>value</BookingCurrencyCode>
        <LanguageCode>value</LanguageCode>
        <OfficeCode>DEU</OfficeCode>
    </BookingContext>
    <CruiseComponent>
        <ComponentID>value</ComponentID>
        <PromotionCode>didu20198212</PromotionCode>

I need to create the field OfficeCode then take the value to create a dashboard.

Splunk in automatic way do not recognize this field, could you help me to create a regular expression?

Thanks
Massimiliano

0 Karma
Highlighted

Re: How to create a regular expression for a field in a log file?

Legend

Try this

... | rex "OfficeCode\>(?<office_code>\w+)\<" |...
0 Karma
Highlighted

Re: How to create a regular expression for a field in a log file?

Motivator

The one given by @sundareshr should work fine if office code has \w worth of data, however if there are more than \w type of data that can be part of officeCode then you can give this a try as well as \w only covers [a-zA-Z0-9_]:

... | rex "OfficeCode\>(?<OfficeCode>[^\<]+)\<" | table OfficeCode

View solution in original post

Highlighted

Re: How to create a regular expression for a field in a log file?

New Member

Thank you both the expression works well!

0 Karma