Splunk Search

How to extract the field value which has space

Anush
Engager

Below is the sample field value from the event, 

 sourceServiceName=Endpoint Web analyzedBy=Policy Engine Status=New Success=True

By default, the field value detects only Endpoint and not the full text Endpoint Web

Som I used the below rex command but it didn't work,

rex "sourceServiceName=(?<sourceServiceName>[^\"]+)"    - This one fetches all the text starting from "Endpoint to end of that event" 

Also the value of the field sourceServiceName can be anything, i.e -Endpoint Web or Endpoint Printing Endpoint USB  etc. First word -Endpoint Second word -any can any word

I want to fetch only the value of field serviceSourceName

Can you please help?

 

 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this

index=_internal
| head 1
| eval _raw = "sourceServiceName=Endpoint Web analyzedBy=Policy Engine Status=New Success=True Some=Other fields"
```Previous was set up the data, next one is the logic```
| rex "sourceServiceName=(?<sourceServiceName>[\w\s]+)\s+\w+="

r. Ismo 

View solution in original post

0 Karma

Anush
Engager

Thanks a lot. It worked

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this

index=_internal
| head 1
| eval _raw = "sourceServiceName=Endpoint Web analyzedBy=Policy Engine Status=New Success=True Some=Other fields"
```Previous was set up the data, next one is the logic```
| rex "sourceServiceName=(?<sourceServiceName>[\w\s]+)\s+\w+="

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...