Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to extract IP hostname SplunkAgent and Machine...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10.179.130.56 - - [14/Apr/2023:01:59:28.233 +0800] "POST /services/broker/phonehome/connection_10.179.130.56_8089_10.179.130.56_MYETKPWSQL002_918B12BB-35AB-452A-BAEB-592395125496 HTTP/1.1" 200 530 "-" "Splunk/8.2.7 (Windows Server 10 Standard Edition; arch=x64)" - 1ms
10.16.36.90 - - [13/Apr/2023:18:27:12.290 +0000] "POST /services/broker/phonehome/connection_10.16.36.90_8089_usseacwsrv190.us.xyz.com_usseacwsrv190_4D304A0A-05E2-483B-B2B5-7CF8A8928B7A HTTP/1.1" 200 24 "-" "Splunk/8.2.7 (Windows Server 10 Datacenter Edition; arch=x64)" - 2ms
Hi Everyone
Please help me with the regex to extract the following fields highlighted in bold.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| makeresults
| eval _raw="10.179.130.56 - - [14/Apr/2023:01:59:28.233 +0800] \"POST /services/broker/phonehome/connection_10.179.130.56_8089_10.179.130.56_MYETKPWSQL002_918B12BB-35AB-452A-BAEB-592395125496 HTTP/1.1\" 200 530 \"-\" \"Splunk/8.2.7 (Windows Server 10 Standard Edition; arch=x64)\" - 1ms"
| rex "(?<src>\S+)\s*(?<foo>\S+)\s*(?<bar>\S+)\s+\[(?<timestamp>[^\]]+)\]\s+\"(?<request>[^\"]+)\"\s+(?<http_response_code>\d+)\s*(?<other_code>\d+)\s+\"(?<bat>[^\"]+)\"\s+\"(?<spunk_agent>\S+)\s+(?<architecture>[^\"]+)\"\s+(?<boo>\S+)\s+(?<response_time>\S+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| makeresults
| eval _raw="10.179.130.56 - - [14/Apr/2023:01:59:28.233 +0800] \"POST /services/broker/phonehome/connection_10.179.130.56_8089_10.179.130.56_MYETKPWSQL002_918B12BB-35AB-452A-BAEB-592395125496 HTTP/1.1\" 200 530 \"-\" \"Splunk/8.2.7 (Windows Server 10 Standard Edition; arch=x64)\" - 1ms"
| rex "(?<src>\S+)\s*(?<foo>\S+)\s*(?<bar>\S+)\s+\[(?<timestamp>[^\]]+)\]\s+\"(?<request>[^\"]+)\"\s+(?<http_response_code>\d+)\s*(?<other_code>\d+)\s+\"(?<bat>[^\"]+)\"\s+\"(?<spunk_agent>\S+)\s+(?<architecture>[^\"]+)\"\s+(?<boo>\S+)\s+(?<response_time>\S+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The following should work on both examples:
| rex field=_raw "^(?<field1>(\d+\.?){4})[^"]+\"\w+\s(\/\w+)+([^_]+_){3}(?<field2>[^_]+).+(?<field3>Splunk[^\;]+);"
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Community Badges!
How to find the worst searches in your Splunk environment and how to fix them
Share Your Feedback: On Admin Config Service (ACS)!
