Splunk Search

How to extract a field that can possibly have null values?

chengka
Explorer

I have managed to create many field extractions, but my latest has me stumped.

My events are formatted by a vendor, so I can't change them. My goal is to extract fields for the bolded items in a way that I can search and report on them. Typically the value exists between the (). Most of them are easy but I don't know how to deal with the fields like MCAUSER which only contains '' between the () and TRIGGER/NOTRIGGER which are one of the other.

My current extraction creates a field of MCAUSER = BADUSER for event 2, but no MCAUSER field at all for event 1. Here is my current regex
^**[\S\W.]+MCAUSER('(?P[^']+)

Event 1
DEFINE CHANNEL('SYSTEM.DEF.SVRCONN') CHLTYPE(SVRCONN) REPLACE+
DESCR('') +
MCAUSER('') +
TRIGGER +
HBINT(300)

Event 2
DEFINE CHANNEL('SYSTEM.ALT.SVRCONN') CHLTYPE(SVRCONN) REPLACE +
DESCR('') +
MCAUSER('BADUSER') +
NOTRIGGER +
HBINT(300)

My other thought is perhaps I could get away with a search that identifies events that do not contain a field MCAUSER, "NOT MCAUSER=*" seems to work, but without a value, I can't seem to create a count which includes the '' via "| stats count by MCAUSER"

Tags (2)
0 Karma

_d_
Splunk Employee
Splunk Employee

Try this regex:

MCAUSER\('(?<MCAUSER>[^']*)'\)

that will look for the string MCAUSER and extract everything between (' and ') in a field called MCAUSER

0 Karma

ShaneNewman
Motivator

Have you considered using fillnull value="some value" MCAUSER | stats count by MCAUSER ? Maybe I am not fully understanding your question...

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...