Splunk Search

How to extract a field from two slightly different formatted events?

stefi_bozova
Engager

Hi all,

I'm trying to do a field extraction of database name (let's call the field "DBname") from logs that come in 2 formats:

Jan 19 15:58:06 192.168.1.2 Jan 19 15:58:06 Message forwarded from Database1: Oracle Audit blablablabla
Jan 20 06:36:17 192.168.1.3 Jan 20 06:36:17 Database2 journal: Oracle Audit blablablablabla
Jan 21 06:36:17 192.168.1.4 Jan 21 06:36:17 Database_10 journal: Oracle Audit blablablablabla
Jan 22 15:58:06 192.168.1.5 Jan 22 15:58:06 Message forwarded from Database4: Oracle Audit blablablabla
Jan 23 15:58:06 192.168.1.6 Jan 23 15:58:06 Message forwarded from prmds1: Oracle Audit blablablabla
Jan 24 15:58:06 192.168.1.7 Jan 24 15:58:06 Message forwarded from Database_15: Oracle Audit blablablabla
Jan 26 15:58:06 192.168.1.9 Jan 26 15:58:06 Message forwarded from prmds2: Oracle Audit blablablabla
Jan 27 15:58:06 192.168.1.8 Jan 27 15:58:06 fafa32 journal: Oracle Audit blablablablabla

So, the "DBname" field value comes after "Message forwarded from" or before "journal". Splunk fails with the regex and unfortunately so do I. I found it's an issue that the events are so similarly formatted in this case 😄 My question is if I am missing something with the regex or I should approach it in a completely different manner. 

Thank you for the help!

Labels (1)
1 Solution

BahadirS
Path Finder

You can use branch reset group in your expression.

Something like this would solve your problem. 

(?|from\s(?<db>[^:]+):|\s(?<db>[^\s]+)\sjournal)

View solution in original post

stefi_bozova
Engager

Great thanks to you, @BahadirS and @richgalloway ,  both solutions work like a charm!

 

BahadirS
Path Finder

You can use branch reset group in your expression.

Something like this would solve your problem. 

(?|from\s(?<db>[^:]+):|\s(?<db>[^\s]+)\sjournal)

richgalloway
SplunkTrust
SplunkTrust

We can do that at search time using two rex commands and then selecting the non-null result.

| rex "forwarded from (?<DBname1>\w+)"
| rex "(?<DBname2>\w+) journal:"
| eval DBname=coalesce(DBname1, DBname2)

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...