Splunk Search

How to extract the severity value from the events with different formats?

shanmugavelv
New Member

For example - I have the below different types of events under same index, all i need from this is the INFO, DEBUG, ERROR etc.(highlighted ones)

2017-07-11 16:01:52.9853 [10] [host-name] [Rabc.Gtgefsefwe.Sefwerg.werwer] DEBUG: erwer.wer.Sla.wer.wer.dfgdfg, gfh job.
2017-07-13 16:28:48.7464 [16] sdfsdgsdg.werwer.werwerewr DEBUG: Bath erwerwer of 1 triggers
2017-07-13 16:28:47.1820 [5] [hodt-name] Rewerwerg.Dal.tweewtert.ert.ertertertertert`2[[erterting.wsdfsddswwsssjects.sdfsggdg.Dtos.rrtrtw.UsefvbchdftrrtInfoDto, Rttererkng.sdfsdfsdfsdfsdf.weqwrerewt, Version=1.0.0.1, Cuure=neutral, PublicKeyToken=null],[wertwerwng.Data.werwer.werwer.User, rwertwerwe.Data.vgdfgdfg, Version=1.0.6372.25861, Culture=neutral, PublicKeyToken=null]]] INFO: No records to process. No Bulk insert of Entity: dfgdfgdfg.Data.dfgdfg.EntityModels.User is required.

Tags (1)
0 Karma

sbbadri
Motivator

try this

your base search | rex field=test "\d+-\d+-\d+\s\d+:\d+:\d+.\d+\S+.*(?P(DEBUG|INFO))"

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...