Splunk Search

How to extract the following fields?

sphiwee
Contributor

2022-02-03 12:07:12 [machine-run-00000-hit-000000-step-00000] [[Card Onboarding] CCC Capture - Logging Framework] [Card Onboarding business process v3.0.0_logging (CardOnboardingCPSCapture)] [CC00] CardOnboardingCPSCaptureRobot [ERROR] Error CPS NOT AVAILABLE on CPS screen UNKNOWN

 

Need to extract the above highlighted fields please
2022-02-03 12:07:12 - Date

[Card Onboarding] CCC Capture - Logging Framework - Process

Card Onboarding business process v3.0.0_logging (CardOnboardingCPSCapture) - Step

CC00 - User

ERROR - Log_Level

 

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s+\[(?<Process>\[[^\]]+\][^\]]+)\]\s+\[(?<Step>[^\]]+)\]\s+\[(?<User>[^\]]+)\]\s+[^\[]+\[(?<Log_level>[^\]]+)"

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @sphiwee,

please try this regex:

| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s+\[(?<Process>[^\]]+)\]\s+\[(?<Step>[^\]]+)\]\s+\[(?<User>[^\]]+)\]\s+[^\[]+\[(?<Log_level>[^\]]+)"

that you can test at https://regex101.com/r/Dsqil2/1

Ciao.

Giuseppe

sphiwee
Contributor

getting back an empty result

sphiwee_0-1644475206171.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s+\[(?<Process>\[[^\]]+\][^\]]+)\]\s+\[(?<Step>[^\]]+)\]\s+\[(?<User>[^\]]+)\]\s+[^\[]+\[(?<Log_level>[^\]]+)"
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...