Splunk Search

How to edit my search to extract a specific value from a reoccurring field within a single event?

raby1996
Path Finder

Hi all,

I'm having trouble extracting a specific value from a reoccurring field within a single event. My search looks like this:

index=* sourcetype=collectedCodeLevels.All "HMC Code Levels" " Package Level" AND "Sea.ha"   
| rex (?P<LIC>(?<=Level:)(\s\d+\.\d+\.\d+\.\d(?!.*Level))) 

and the event data looks like this:

 Package : RFD.bla , MTMS: XXXX-XXX*XXXXXXX <BR>    Date: 2012/06/20-16:31, Bundle VRMF: XX.XX.XXX.X , Package Level: X.X.XXX.XX, Mode: CCL<BR> 
  Package: SEA.ha , MTMS: XXXX-XXX*XXXXXXX <BR>    Date: 2014/07/19-16:12, Bundle VRMF: XX.XX.XX.X , Package Level: X.X.X.XXXX, Mode: CCL<BR> <BR>

From this data, I would like to extract the Package Level number (the one after Bundle VRMF) only after the SEA.ha specific occurrence. I've tried using lookaheads and they don't seem to work, and so far I've only been able to extract the first occurrence of that pattern which is wrong.
(P.S. everything i need is within that SEA.ha event so if there's a way to separate that occurrence as a single event, that would work too)
Thank you!

0 Karma
1 Solution

woodcock
Esteemed Legend

My previous answer does not properly handle newlines between the important texts but this one should; try this:

index=* sourcetype=collectedCodeLevels.All "HMC Code Levels" " Package Level" AND "Sea.ha" | rex "(?m)Package:\s+SEA\.ha.*?$[\r\n]+.*?Package Level:\s+(?<SEA_ha_Package_Level>\d+\.\d+\.\d+\.\d+)"

View solution in original post

woodcock
Esteemed Legend

My previous answer does not properly handle newlines between the important texts but this one should; try this:

index=* sourcetype=collectedCodeLevels.All "HMC Code Levels" " Package Level" AND "Sea.ha" | rex "(?m)Package:\s+SEA\.ha.*?$[\r\n]+.*?Package Level:\s+(?<SEA_ha_Package_Level>\d+\.\d+\.\d+\.\d+)"

woodcock
Esteemed Legend

Try this:

 index=* sourcetype=collectedCodeLevels.All "HMC Code Levels" " Package Level" AND "Sea.ha" | rex "(?m)Package:\s+SEA.ha.*?Package Level:\s+(?<SEA_ha_Package_Level>\d+\.\d+\.\d+\.\d+)"

raby1996
Path Finder

Hmm maybe this example is better
Package: SEA.ha , MTMS: XXXX-XXX*XXXXXXX
Date: 2015/07/18-20:40, Bundle VRMF: X.X.XX.XX , Package Level: X.X.XX.XX, Mode: REMOTE_CCL
Package: SEA.se , MTMS: XXXX-XXX*XXXXXXX
Date: 2015/07/18-21:05, Bundle VRMF: X.X.XX.XX , Package Level: X.X.XX.XX, Mode: REMOTE_CCL

0 Karma

raby1996
Path Finder

It didn't extract anything, still thank you

0 Karma

raby1996
Path Finder

actually with a little bit of tweaking it worked thanks ! I replaced ".?" with "(?:\n|.) ?"
so now my code looks like
index=* sourcetype=collectedCodeLevels.All "HMC Code Levels" " Package Level" AND "Sea.ha"| rex (?m)(?\s\d+\.\d+\.\d+\.\d+)| rex "(?m)Package:\s+SEA.ha**(?:\n|.)*?Package Level:\s+(?\d+\.\d+\.\d+\.\d+)"

0 Karma

woodcock
Esteemed Legend

I am not sure how that is possible because I used your event data and tested my solution against it and it worked perfectly. Are you sure that the event that you put in your question is completely correct?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...