How to extract multiple fields and create a table?

[bharat149]

02.08.2023 12:44:10.690 *INFO* [sling-threadpool-2cfa6523-0895-49ea-bb99-ae6f63c25cf6-32-Create Site from Template(aaa/jobs/abc)] bbb.CreateSiteFromSiteTemplateJobExecutor Private Site : ‘site4’ created by user : ‘admin’ with MRNumber :  ‘dr4’

I want to extract site , user and DR number and create table

[ITWhisperer]

You have been shown how to use rex before - how could you modify this to locate (anchor) the string that you want and extract the data into a field using a pattern?

Get customer ID form logs - Splunk Community

[bharat149]

Spoiler

i need splunk querry

[ITWhisperer]

OK what rex command have you tried so far?

[bharat149]

sourcetype=log | rex "Private Site : ‘(?[^’]+)’ created by user : ‘(?[^’]+)’ with DRNumber : ‘(?[^’]+)’" | table site, user ,drnumber

[ITWhisperer]

Looks like you just need to name the capture groups with the field names you want to use

sourcetype=log | rex "Private Site : '(?<site>[^']+)' created by user : '(?<user>[^']+)' with DRNumber : '(?<drumber>[^']+)'" | table site, user ,drnumber

By the way, it looks like the single quotes may have been changed when you pasted your example in. It is best to use code blocks </> as I have just done to ensure formatting and content changes don't occur when showing events and SPL code.

[bharat149]

source="error1.log" host="Bharats-MacBook-Pro.local" sourcetype="test1" | rex "Private Site : '(?<site>[^']+)' created by user : '(?<user>[^']+)' with DRNumber : '(?<drNumber>[^']+)'"

Rex is not wokring all the logs are getting printed

[ITWhisperer]

Your search doesn't appear to have any filtering so I would have expected all logs to have been shown

[bharat149]

How to selected only the rex events only

[ITWhisperer]

You could add your anchor strings to the initial search

sourcetype=log "Private Site : " " created by user : " " with DRNumber :" | rex "Private Site : '(?<site>[^']+)' created by user : '(?<user>[^']+)' with DRNumber : '(?<drumber>[^']+)'" | table site, user ,drnumber

[bharat149]

Not working