Splunk Search

How to extract a field that appears in 3 different formats?

Bagaboo
Engager

Hello,

I am using Splunk Light to create a proof of concept with Splunk.

I have imported a .csv file. One of the columns has a "message".
The message sometimes contains an ActivityID.
The ActivityID has three inconsistent shapes:
1. ActivityID: 00000000-0000-0000-0000-000000000000
2. ActivityID 00000000-0000-0000-0000-000000000000
3. activityid_00000000-0000-0000-0000-000000000000

I want to extract the field based on the above.

I succeeded to extract the first one. When I add the second one, it fails to do so and throws an error.
I tried to create two different definitions with the same name. The seconds one fails because ActivityID already exists.

What are your recommendations?

0 Karma
1 Solution

MuS
Legend

Hi Bagaboo,

based on the examples, try this regex as your field extraction:

[Aa]ctivity[iIdD]+[\s:_]+(?<ActivityID>)[^$]+

you can verify it first in a search:

your base search here | rex "[Aa]ctivity[iIdD]+[\s:_]+(?<ActivityID>)[^$]+" | do more stuff 

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi Bagaboo,

based on the examples, try this regex as your field extraction:

[Aa]ctivity[iIdD]+[\s:_]+(?<ActivityID>)[^$]+

you can verify it first in a search:

your base search here | rex "[Aa]ctivity[iIdD]+[\s:_]+(?<ActivityID>)[^$]+" | do more stuff 

Hope this helps ...

cheers, MuS

0 Karma

Bagaboo
Engager

Thank you MuS. Based on your input i tried...

[Aa]ctivity[iIdD]+[\s:_]+(?P<ActivityID>[^,]+)

...and it worked like a charm. It is extracting all three field variants and getting me the guids flawlessly. Although i got different results when i tried it in the search.

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...