Splunk Search

How to extract fields with empty values at index time?

New Member

In our logs, we have the below two lines where we need to extract both empty & values for Dms_Code. Currently we are getting only values, but not empty, due to this other values are not getting populated in the UI.

Regex :

EXTRACT-Server_Name=\[(?<TimeDate>[^]]+)\]\s\[(?P<Server_Name>[^]]+)\]\s\[(?P<severity>[^]]+)\]\s\[\w+\-(?P<Dms_Code>[^]]+)\]\s\[(?P<Incident>[^]]+)\]\s


[2014-07-16T22:38:17.251+08:00] [apj_corp1_osb_dit_admin] [NOTIFICATION] [] [oracle.security.audit.logger]

[2014-07-16T22:37:47.379+08:00] [apj_corp1_osb_dit_admin] [WARNING] [DMS-50966] [oracle.dms.collector]
Tags (2)
0 Karma

Revered Legend

Try this

EXTRACT-Server_Name = \[(?<TimeDate>[^\]]+)\]\s\[(?P<Server_Name>[^\]]+)\]\s\[(?P<severity>[^\]]+)\]\s\[(\w+-)*(?P<Dms_Code>\d*)]\s\[(?<Incident>[^\]]+)\]

Influencer

I think it is because in your regex you have used w+ for Dms_Code, it is not getting empty values. Modify your regex to accept empty values also.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!