Splunk Search

How to extract information from my sample log file?

New Member

I am new to Splunk but am given a tight deadline to explore the possibility of using Splunk to extract information from a log file that consists of the following 3 typical lines:

2015-05-01 07:33 - [User Login] | Name#ID | 'John#11' | :User name: 'John', ID: '11' successfully logged in
2015-05-02 17:07 - [Search] | Name#ID | 'Sue#222' | :Estimated time | '2,06ms' |, Result count | '23' |, Search Terms | '{"Type":"ALL","Tag":[],"sn":"","searchEndDate":null,"Query":"storm","searchStartDate":1428249600000}' |
2015-05-03 09:18 - [Edit] | Name#ID | 'Tom#3333' | :Announcement 'Maintenance' updated successfully.

May I know how I can construct the Splunk query statement to extract the Action (ie, User Login, Search, Edit), User Name (ie, John, Sue, Tom), ID (ie, 11, 222, 3333), Search Time Taken (ie, 2,06ms), Search Count (ie, 23) and Search Terms (ie, {"Type":"ALL","Tag":[],"sn":"","searchEndDate":null,"Query":"storm","searchStartDate":1428249600000})?

Tags (1)
0 Karma
1 Solution

Esteemed Legend

Try this:

... | rex "[^\[]*\[(?<Action>[^\]]*)\].*Name#ID \| '(?<UserName>[^#]*)#(?<ID>[^']*)" | rex ".*Estimated time \| '(?<SearchTimeTaken>[^']*)' \|, Result count \| '(?<SearchCount>\d+)' \|, Search Terms \| '\{(?<SearchTerms>[^\}]*)\}'"

View solution in original post

0 Karma

Esteemed Legend

Try this:

... | rex "[^\[]*\[(?<Action>[^\]]*)\].*Name#ID \| '(?<UserName>[^#]*)#(?<ID>[^']*)" | rex ".*Estimated time \| '(?<SearchTimeTaken>[^']*)' \|, Result count \| '(?<SearchCount>\d+)' \|, Search Terms \| '\{(?<SearchTerms>[^\}]*)\}'"

View solution in original post

0 Karma

New Member

Thanks a lot! It works!

0 Karma