Splunk Search

How to extract the following fields?

sphiwee
Communicator

2022-02-03 12:07:12 [machine-run-00000-hit-000000-step-00000] [[Card Onboarding] CCC Capture - Logging Framework] [Card Onboarding business process v3.0.0_logging (CardOnboardingCPSCapture)] [CC00] CardOnboardingCPSCaptureRobot [ERROR] Error CPS NOT AVAILABLE on CPS screen UNKNOWN

 

Need to extract the above highlighted fields please
2022-02-03 12:07:12 - Date

[Card Onboarding] CCC Capture - Logging Framework - Process

Card Onboarding business process v3.0.0_logging (CardOnboardingCPSCapture) - Step

CC00 - User

ERROR - Log_Level

 

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s+\[(?<Process>\[[^\]]+\][^\]]+)\]\s+\[(?<Step>[^\]]+)\]\s+\[(?<User>[^\]]+)\]\s+[^\[]+\[(?<Log_level>[^\]]+)"

View solution in original post

gcusello
Esteemed Legend

Hi @sphiwee,

please try this regex:

| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s+\[(?<Process>[^\]]+)\]\s+\[(?<Step>[^\]]+)\]\s+\[(?<User>[^\]]+)\]\s+[^\[]+\[(?<Log_level>[^\]]+)"

that you can test at https://regex101.com/r/Dsqil2/1

Ciao.

Giuseppe

sphiwee
Communicator

getting back an empty result

sphiwee_0-1644475206171.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s+\[(?<Process>\[[^\]]+\][^\]]+)\]\s+\[(?<Step>[^\]]+)\]\s+\[(?<User>[^\]]+)\]\s+[^\[]+\[(?<Log_level>[^\]]+)"
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...