Splunk Search

How to extract a field with regex

maria_n
Explorer

Hi Everyone

Sample logs:

{"kubernetes":{"container_name":"sign-template-services","namespace_name":"merch-ps-signs-stress-1","pod_name":"sign-template-services-14-chfbn"},"message":"::ffff:100.65.19.1 - - [05-Mar-2020 09:58:48 CST] \"GET /health HTTP/1.1\" 200 30 - **7.807** ms\n","hostname":"ocp-usc1-lle-b-app-f-g3q9.c.kohls-openshift-lle.internal","@timestamp":"2020-03-05T15:58:48.231999+00:00","cluster_name":"ocp.gcpusc1-b.lle.xpaas"}

{"kubernetes":{"container_name":"sign-template-services","namespace_name":"merch-ps-signs-ci","pod_name":"sign-template-services-39-gb69d"},"message":"::ffff:100.109.92.1 - - [05-Mar-2020 09:57:31 CST] \"GET /health HTTP/1.1\" 200 30 - **33.245** ms\n","hostname":"ocp-usc1-lle-c-app-f-7ml9.c.kohls-openshift-lle.internal","@timestamp":"2020-03-05T15:57:31.808739+00:00","cluster_name":"ocp.gcpusc1-c.lle.xpaas"}

We need to extract a field called "Response_Time" which is highlighted in these logs. The data is available in the field "message".
I have tried the below regex but it does not seem to work.

index=kohls_prod_infrastructure_openshift_raw kubernetes.container_name=sign-template-services 
| rex field=MESSAGE "\d{3} d{2} - (?\d+) ms\""

Please help!

Thanks.

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @maria_n,

Try this:

index=kohls_prod_infrastructure_openshift_raw kubernetes.container_name=sign-template-services 
| rex field=message "-\s(?<Response_Time>[\d\.]+)"

Sample query:

| makeresults 
| eval message = "::ffff:100.65.19.1 - - [05-Mar-2020 09:58:48 CST] \"GET /health HTTP/1.1\" 200 30 - 7.807 ms\n" 
| rex field=message "-\s(?<Response_Time>[\d\.]+)"

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

hi @maria_n,

Try this:

index=kohls_prod_infrastructure_openshift_raw kubernetes.container_name=sign-template-services 
| rex field=message "-\s(?<Response_Time>[\d\.]+)"

Sample query:

| makeresults 
| eval message = "::ffff:100.65.19.1 - - [05-Mar-2020 09:58:48 CST] \"GET /health HTTP/1.1\" 200 30 - 7.807 ms\n" 
| rex field=message "-\s(?<Response_Time>[\d\.]+)"

darrenfuller
Contributor

you didn't give the field a name and you didn't capture the period. Try something like:

rex field=message"\d{3}\s\d{2}\s\-\s(?<Response_Time>[\d\.]+)\sms"

./DF

gcusello
Legend

Hi @maria_n,
only one question: the field is "message" or "MESSAGE"? check the correct case.
try something like this:

index=kohls_prod_infrastructure_openshift_raw kubernetes.container_name=sign-template-services
| rex field=MESSAGE "\s+(?<Response_Time>[^ ]+)\sms"

you can test the regex at https://regex101.com/r/82WdWC/1

Ciao.
Giuseppe

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...