Splunk Search

How to extract a field that appears in 3 different formats?

Bagaboo
Engager

Hello,

I am using Splunk Light to create a proof of concept with Splunk.

I have imported a .csv file. One of the columns has a "message".
The message sometimes contains an ActivityID.
The ActivityID has three inconsistent shapes:
1. ActivityID: 00000000-0000-0000-0000-000000000000
2. ActivityID 00000000-0000-0000-0000-000000000000
3. activityid_00000000-0000-0000-0000-000000000000

I want to extract the field based on the above.

I succeeded to extract the first one. When I add the second one, it fails to do so and throws an error.
I tried to create two different definitions with the same name. The seconds one fails because ActivityID already exists.

What are your recommendations?

0 Karma
1 Solution

MuS
Legend

Hi Bagaboo,

based on the examples, try this regex as your field extraction:

[Aa]ctivity[iIdD]+[\s:_]+(?<ActivityID>)[^$]+

you can verify it first in a search:

your base search here | rex "[Aa]ctivity[iIdD]+[\s:_]+(?<ActivityID>)[^$]+" | do more stuff 

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi Bagaboo,

based on the examples, try this regex as your field extraction:

[Aa]ctivity[iIdD]+[\s:_]+(?<ActivityID>)[^$]+

you can verify it first in a search:

your base search here | rex "[Aa]ctivity[iIdD]+[\s:_]+(?<ActivityID>)[^$]+" | do more stuff 

Hope this helps ...

cheers, MuS

0 Karma

Bagaboo
Engager

Thank you MuS. Based on your input i tried...

[Aa]ctivity[iIdD]+[\s:_]+(?P<ActivityID>[^,]+)

...and it worked like a charm. It is extracting all three field variants and getting me the guids flawlessly. Although i got different results when i tried it in the search.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...