Splunk Search

How to extract status for monitoring with a log structure like this?

phamxuantung
Communicator

Hello,

I have a log file that go like this

 

 

2022-09-30 09:43:41,038: INSTANCE=34-bankgw1, REF=237324562, MESSSAGE=IST2InterfaceModel.ResponseVerifyCardFromBank:{"F0":"0210","F2":"970422xxxxxx6588","F3":"050000","F4":"000001000000","F7":"0930094340","F9":"00000001","F11":"277165","F12":"094340","F13":"0930","F15":"0930","F18":"7399","F25":"08","F32":"970471","F37":"273094277165","F38":"277165","F39":"15","F41":"00005782",0822,237324562,VNPAYCE","F49":"704","F54":"0000000000000000000000000000000000000000","F62":"EC_CARDVER","F63":"AAsA7QKwYzZX3AAB","F102":"0000000000000000"}

 

 

With a log structure like this, I can't really extract the field that I want with Splunk field extractor. The field that I want to Extract is F39 (which mean status) for monitoring purpose.

I'm really amateur when it come to rex so can anyone help me with it?

Labels (3)
0 Karma
1 Solution

chaker
Contributor

Hi @phamxuantung 

Give this a try

|rex field=_raw "\"F39\"\:\"(?<F39>\d+?)\""

Most of this log can be extracted using this method. The fields with a string value will need to be changed.

View solution in original post

chaker
Contributor

Hi @phamxuantung 

Give this a try

|rex field=_raw "\"F39\"\:\"(?<F39>\d+?)\""

Most of this log can be extracted using this method. The fields with a string value will need to be changed.

phamxuantung
Communicator

Thanks, this work perfectly, but can I ask why fields with string value need to be change and why?

0 Karma

chaker
Contributor

Hi @phamxuantung ,

It's because the regex I have you is looking for digits using \d

In this example, field F62 is extracted. I used a wildcard so it will catch anything in that field regardless of digit or string match.

|rex field=_raw "\"F62\"\:\"(?<F62>.+?)\""

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...