Splunk Search

How to extract multiple fields and create a table?

bharat149
Explorer

02.08.2023 12:44:10.690 *INFO* [sling-threadpool-2cfa6523-0895-49ea-bb99-ae6f63c25cf6-32-Create Site from Template(aaa/jobs/abc)] bbb.CreateSiteFromSiteTemplateJobExecutor Private Site : ‘site4’ created by user : ‘admin’ with MRNumber :  ‘dr4’

I want to extract site , user and DR number and create table

Labels (2)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have been shown how to use rex before - how could you modify this to locate (anchor) the string that you want and extract the data into a field using a pattern?

Get customer ID form logs - Splunk Community

0 Karma

bharat149
Explorer
Spoiler
i need splunk querry
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK what rex command have you tried so far?

0 Karma

bharat149
Explorer

sourcetype=log | rex "Private Site : ‘(?[^’]+)’ created by user : ‘(?[^’]+)’ with DRNumber : ‘(?[^’]+)’" | table site, user ,drnumber

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Looks like you just need to name the capture groups with the field names you want to use

sourcetype=log | rex "Private Site : '(?<site>[^']+)' created by user : '(?<user>[^']+)' with DRNumber : '(?<drumber>[^']+)'" | table site, user ,drnumber

By the way, it looks like the single quotes may have been changed when you pasted your example in. It is best to use code blocks </> as I have just done to ensure formatting and content changes don't occur when showing events and SPL code.

0 Karma

bharat149
Explorer

source="error1.log" host="Bharats-MacBook-Pro.local" sourcetype="test1" | rex "Private Site : '(?<site>[^']+)' created by user : '(?<user>[^']+)' with DRNumber : '(?<drNumber>[^']+)'"

Rex is not wokring all the logs are getting printed

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your search doesn't appear to have any filtering so I would have expected all logs to have been shown

0 Karma

bharat149
Explorer

How to selected only the rex events only

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could add your anchor strings to the initial search

sourcetype=log "Private Site : " " created by user : " " with DRNumber :" | rex "Private Site : '(?<site>[^']+)' created by user : '(?<user>[^']+)' with DRNumber : '(?<drumber>[^']+)'" | table site, user ,drnumber
0 Karma

bharat149
Explorer

Not working 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...