Splunk Search

How to do splunk field extraction from a summary index?

Mostafa3081
New Member

I have an event log that looks like this

search_name=x, search_now=3.000, info_min_time=1692741600.000, info_max_time=1692828000.000, info_search_time=1692847620.636, app=Digital,
text="<a href=\"https://support.vodafone.co.uk/1627646512 \" target=\"_blank\"> ...etc ", info_log=l

use the command ... | table text to extract the 'text' field, you get the expected result  <a href=\"https://support.vodafone.co.uk/1627646512 \" target=\"_blank\"> ...etc 

However, when I attempt to extract the same 'text' field from the same event, but this time from a summary index, I  get a different result <a href=\ 
and the whole value is presented in the event tap when i enable the verbose mode so the whole value is in the summary index but i can't show it. 

how to prevent splunk from truncating the result if it is in the summary index 
 
 
Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mostafa3081,

let me understand: you want to extract a part of a field in a summary index, is it correct?

If this is your requirement and if you can, the easiest way is to save the field to extract in the summary generating search.

Anyway, you can extract the part of the "text" field using a rex command:

| rex field=text "href\=\\\"(?<url>[^ ]*)"

that you can test at https://regex101.com/r/6jptux/1

Ciao.

Giuseppe

 

0 Karma

Mostafa3081
New Member

thanks for your replay.

No, I want the exact opposite. I want to extract the entire text value. I received a truncated version, and I can use regex to extract the complete value. However, why did the value get truncated when retrieved from a summary index but not from the normal index?

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...