Splunk Search

How to extract desired data from search result?

sneha03
New Member

Hi Team,

We are trying below search:

 

index=index_123 host=xyz source="/sys_apps_01/pqr/logs/xyz/mapper_xyz.log" ContextKeyMatch: Context Field Value 

 

which gives below results with multiple rows as below:

sneha03_0-1652269980209.png

Now we want to extract data after Context Filed Value. The string having "Context Filed Value" is of variable string length

We have multiple rows like above and we need to extract such data from each row. like : 005436213114023275.

Once we have the extracted data we need to fetch only  last 12 digits

Could you please suggest regarding this?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| rex "Context Field Value\s+\d*(?<value>\d{12})"
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Ideally, you should have this defined as an automatically extracted field so you don't have to do it ad-hoc every time. But for a one-off extraction you can do it with the rex command. Something like this:

<your search>
| rex "Context Filed Value.*(?<my_field>\d{12})$"

 

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...