Splunk Search

How to extract event_id and STATUS?


I have a single row event that populates the below values and i would like to extract eventid=389643 and STATUS=FINISHED using regex. Could you help me with the regex pattern to extract these values.

2017-10-30 06:48:03,357 [pool-22-thread-1] INFO xxxxxxxxxxxxxxxxxxxxxxx - Email Sent
To : xxxxxxxxxxxxxxxxxxxxxxxx
From : xxxxxxxxxxxxxxxxxxxxxxxxxxxx
Subject : Plan Status - 389643 FINISHED
Body : Plan Status - 389643 FINISHED

0 Karma


Try this

| rex Status\s\-\s(?<eventid>\d+)

| rex -\s\d+\s(?<STATUS>\w+)

Splunk Employee
Splunk Employee

Try this: <yoursearch> | rex field=_raw "(?<eventID>\d+)\s(?<STATUS>\w+)$"

This assumes that there is nothing in the event after your status value (the RegEx anchors to the end of _raw)

... | rex "Subject : Plan Status - (?<eventID>\d+)\s(?<STATUS>\w+)"

will work if you have additional stuff after that last line.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...