Splunk Search

How to extract a field that can possibly have null values?

chengka
Explorer

I have managed to create many field extractions, but my latest has me stumped.

My events are formatted by a vendor, so I can't change them. My goal is to extract fields for the bolded items in a way that I can search and report on them. Typically the value exists between the (). Most of them are easy but I don't know how to deal with the fields like MCAUSER which only contains '' between the () and TRIGGER/NOTRIGGER which are one of the other.

My current extraction creates a field of MCAUSER = BADUSER for event 2, but no MCAUSER field at all for event 1. Here is my current regex
^**[\S\W.]+MCAUSER('(?P[^']+)

Event 1
DEFINE CHANNEL('SYSTEM.DEF.SVRCONN') CHLTYPE(SVRCONN) REPLACE+
DESCR('') +
MCAUSER('') +
TRIGGER +
HBINT(300)

Event 2
DEFINE CHANNEL('SYSTEM.ALT.SVRCONN') CHLTYPE(SVRCONN) REPLACE +
DESCR('') +
MCAUSER('BADUSER') +
NOTRIGGER +
HBINT(300)

My other thought is perhaps I could get away with a search that identifies events that do not contain a field MCAUSER, "NOT MCAUSER=*" seems to work, but without a value, I can't seem to create a count which includes the '' via "| stats count by MCAUSER"

Tags (2)
0 Karma

_d_
Splunk Employee
Splunk Employee

Try this regex:

MCAUSER\('(?<MCAUSER>[^']*)'\)

that will look for the string MCAUSER and extract everything between (' and ') in a field called MCAUSER

0 Karma

ShaneNewman
Motivator

Have you considered using fillnull value="some value" MCAUSER | stats count by MCAUSER ? Maybe I am not fully understanding your question...

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...