Splunk Search

How to extract a field from two slightly different formatted events?

stefi_bozova
Engager

Hi all,

I'm trying to do a field extraction of database name (let's call the field "DBname") from logs that come in 2 formats:

Jan 19 15:58:06 192.168.1.2 Jan 19 15:58:06 Message forwarded from Database1: Oracle Audit blablablabla
Jan 20 06:36:17 192.168.1.3 Jan 20 06:36:17 Database2 journal: Oracle Audit blablablablabla
Jan 21 06:36:17 192.168.1.4 Jan 21 06:36:17 Database_10 journal: Oracle Audit blablablablabla
Jan 22 15:58:06 192.168.1.5 Jan 22 15:58:06 Message forwarded from Database4: Oracle Audit blablablabla
Jan 23 15:58:06 192.168.1.6 Jan 23 15:58:06 Message forwarded from prmds1: Oracle Audit blablablabla
Jan 24 15:58:06 192.168.1.7 Jan 24 15:58:06 Message forwarded from Database_15: Oracle Audit blablablabla
Jan 26 15:58:06 192.168.1.9 Jan 26 15:58:06 Message forwarded from prmds2: Oracle Audit blablablabla
Jan 27 15:58:06 192.168.1.8 Jan 27 15:58:06 fafa32 journal: Oracle Audit blablablablabla

So, the "DBname" field value comes after "Message forwarded from" or before "journal". Splunk fails with the regex and unfortunately so do I. I found it's an issue that the events are so similarly formatted in this case 😄 My question is if I am missing something with the regex or I should approach it in a completely different manner. 

Thank you for the help!

Labels (1)
1 Solution

BahadirS
Path Finder

You can use branch reset group in your expression.

Something like this would solve your problem. 

(?|from\s(?<db>[^:]+):|\s(?<db>[^\s]+)\sjournal)

View solution in original post

stefi_bozova
Engager

Great thanks to you, @BahadirS and @richgalloway ,  both solutions work like a charm!

 

BahadirS
Path Finder

You can use branch reset group in your expression.

Something like this would solve your problem. 

(?|from\s(?<db>[^:]+):|\s(?<db>[^\s]+)\sjournal)

richgalloway
SplunkTrust
SplunkTrust

We can do that at search time using two rex commands and then selecting the non-null result.

| rex "forwarded from (?<DBname1>\w+)"
| rex "(?<DBname2>\w+) journal:"
| eval DBname=coalesce(DBname1, DBname2)

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...