Splunk Search

How to extract these fields from my sample data?

Builder

Hello Experts,

Below is the sample event

event_type:  LogMessage 
    ip:  xx.x.xx.xx 
    job:  router_z1 
    job_index:  1 
    level:  info 
    message_type:  OUT 
    msg:  url.com - [04/01/2017:19:37:03.701 +0000] "GET /api/v1/vha/supported-vehicles HTTP/1.1" 200 0 1565 "-" "fordpass-app-na/17 CFNetwork/808.2.16 Darwin/16.3.0" xx.x.xx.xx:45810 x_forwarded_for:"xxx.xx.xxx.xx, xx.xx.xx.xxx, xx.x.xx.xx" x_forwarded_proto:"https" vcap_request_id:8d612e09-f611-415f-6172-a688700be726 response_time:0.004987 app_id:19065d0e-f6da-4cc3-8a71-581fd768dafe

origin:  gorouter 
source_instance:  1 
source_type:  RTR 
time:  2017-01-04T19:37:03Z 
timestamp:  1483558623706728200

I am trying to extract the "GET /api/v1/vha/supported-vehicles " and other similar kinds like "POST /oauth/token", "GET /eureka/apps/delta" ,GET /api/v1/badges,"GET /api/v1","POST /api/v1/humanify-session" etc in the message field.

I tried using the erex command

erex clean examples="GET /api/v1/badges,GET /api/v1,POST /api/v1/record" 

but it is not showing all of them and I also tried using IFX, but I can only select one field...

Is there any other way to extract all these fields from the msg app other than regex...

Thanks for the help

0 Karma

Motivator

If GET and POST is all you are interested in then you can try this as well:

your base search
| rex "\"(?<actionUri>(GET|POST)\s*?[\S]+)"
| table actionUri

If additional actions are needed feel free to add in (GET|POST|...) part of the above rex

Builder

Thank You!

0 Karma

Revered Legend

Is this a json data?

Try something like for now

your base search | rex "\]\s+\"(?<message>\w+\s+\S+)"

Builder

Hi somesh, so using rex command is the only way to extract them?....is there a way to use IFX or erex

0 Karma

Revered Legend

If your logs and the string that you're trying to extract is not formatted in a standard way (they don't follow same patter/position for all events), the erex and IFX may fail to extract all values. Using your custom regular expression which will explicitly take care of all variation is the way to go in cases like that.

0 Karma

Builder

ok thank you somesh

0 Karma

Revered Legend

You'll be able to save the regular expression that you used in search as field extraction, so that its automatically available (similar to what IFX would have done).

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!