Splunk Search

How to extract these fields from my sample data?

mcvr
New Member

I wanted to extract the below values.

  1. Time Taken
  2. Response code in the string - HTTP/1.1" 200 example, I need to know what the response code is, whether 200/404/500

Sample data:

 Time Taken: 937534 URL_STRING: /account/signin.jsp 95.104.163.4 - - [27/Jul/2015:02:10:34 -0700] "GET /account/signin.jsp?PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374304776473&bmUID=kX4Nj97 HTTP/1.1" 200 Bytes: 97413 "http://www.xxx.com/shop/dept_category.jsp?productSizeSelected=0&pageClicked=0&PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374306291898&bmUID=kX4NaK4" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 YaBrowser/15.6.2311.5029 Safari/537.36"
0 Karma

somesoni2
Revered Legend

See if this works (run anywhere sample based on your data)

| gentimes start=-1 | eval temp="Time Taken: 937534 URL_STRING: /account/signin.jsp 95.104.163.4 - - [27/Jul/2015:02:10:34 -0700] \"GET /account/signin.jsp?PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374304776473&bmUID=kX4Nj97 HTTP/1.1\" 200 Bytes: 97413 \"http://www.xxx.com/shop/dept_category.jsp?productSizeSelected=0&pageClicked=0&PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374306291898&bmUID=kX4NaK4\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 YaBrowser/15.6.2311.5029 Safari/537.36\"" | table temp | rename temp as _raw | rex "Time Taken: (?<TimeTaken>\d+)([^\"]+)\"([^\"]+)\" (?<ResponseCode>\d+)"
0 Karma

krishnarajapant
Path Finder

Hi,

  1. timetaken------- rex "Time Taken:(?\d*)"

  2. status---------- rex "HTTP/\d.\d\"(?\d*)"

you can try with erex command and can get the proper regular expression from job or you can use the knowlede object "field extraction" so that you can get the base regular expression.

Above regular expression required little bit tweaking and testing.

-Krishan Rajapantula.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...