Splunk Search

How to edit my search to extract a specific value from a reoccurring field within a single event?

raby1996
Path Finder

Hi all,

I'm having trouble extracting a specific value from a reoccurring field within a single event. My search looks like this:

index=* sourcetype=collectedCodeLevels.All "HMC Code Levels" " Package Level" AND "Sea.ha"   
| rex (?P<LIC>(?<=Level:)(\s\d+\.\d+\.\d+\.\d(?!.*Level))) 

and the event data looks like this:

 Package : RFD.bla , MTMS: XXXX-XXX*XXXXXXX <BR>    Date: 2012/06/20-16:31, Bundle VRMF: XX.XX.XXX.X , Package Level: X.X.XXX.XX, Mode: CCL<BR> 
  Package: SEA.ha , MTMS: XXXX-XXX*XXXXXXX <BR>    Date: 2014/07/19-16:12, Bundle VRMF: XX.XX.XX.X , Package Level: X.X.X.XXXX, Mode: CCL<BR> <BR>

From this data, I would like to extract the Package Level number (the one after Bundle VRMF) only after the SEA.ha specific occurrence. I've tried using lookaheads and they don't seem to work, and so far I've only been able to extract the first occurrence of that pattern which is wrong.
(P.S. everything i need is within that SEA.ha event so if there's a way to separate that occurrence as a single event, that would work too)
Thank you!

0 Karma
1 Solution

woodcock
Esteemed Legend

My previous answer does not properly handle newlines between the important texts but this one should; try this:

index=* sourcetype=collectedCodeLevels.All "HMC Code Levels" " Package Level" AND "Sea.ha" | rex "(?m)Package:\s+SEA\.ha.*?$[\r\n]+.*?Package Level:\s+(?<SEA_ha_Package_Level>\d+\.\d+\.\d+\.\d+)"

View solution in original post

woodcock
Esteemed Legend

My previous answer does not properly handle newlines between the important texts but this one should; try this:

index=* sourcetype=collectedCodeLevels.All "HMC Code Levels" " Package Level" AND "Sea.ha" | rex "(?m)Package:\s+SEA\.ha.*?$[\r\n]+.*?Package Level:\s+(?<SEA_ha_Package_Level>\d+\.\d+\.\d+\.\d+)"

woodcock
Esteemed Legend

Try this:

 index=* sourcetype=collectedCodeLevels.All "HMC Code Levels" " Package Level" AND "Sea.ha" | rex "(?m)Package:\s+SEA.ha.*?Package Level:\s+(?<SEA_ha_Package_Level>\d+\.\d+\.\d+\.\d+)"

raby1996
Path Finder

Hmm maybe this example is better
Package: SEA.ha , MTMS: XXXX-XXX*XXXXXXX
Date: 2015/07/18-20:40, Bundle VRMF: X.X.XX.XX , Package Level: X.X.XX.XX, Mode: REMOTE_CCL
Package: SEA.se , MTMS: XXXX-XXX*XXXXXXX
Date: 2015/07/18-21:05, Bundle VRMF: X.X.XX.XX , Package Level: X.X.XX.XX, Mode: REMOTE_CCL

0 Karma

raby1996
Path Finder

It didn't extract anything, still thank you

0 Karma

raby1996
Path Finder

actually with a little bit of tweaking it worked thanks ! I replaced ".?" with "(?:\n|.) ?"
so now my code looks like
index=* sourcetype=collectedCodeLevels.All "HMC Code Levels" " Package Level" AND "Sea.ha"| rex (?m)(?\s\d+\.\d+\.\d+\.\d+)| rex "(?m)Package:\s+SEA.ha**(?:\n|.)*?Package Level:\s+(?\d+\.\d+\.\d+\.\d+)"

0 Karma

woodcock
Esteemed Legend

I am not sure how that is possible because I used your event data and tested my solution against it and it worked perfectly. Are you sure that the event that you put in your question is completely correct?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...