Splunk Search

How to extract using rex

avi7326
Path Finder

[-]
   
loggerorg.mule.runtime.core.internal.processor.LoggerMessageProcessor
   
messageReceived update request IL_Customer. Size of array: 1
   
properties: { [-]
     
correlationId4b910aaf-d316-4594-8eda-c56e861499d3
     

I want to extract the IL_customer and array size from the above log. What will be the regular expression.

Thanks in Advance

 

Labels (1)
Tags (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

The values OP is seeking is in the field message. (From the illustration in OP, the event is JSON - but it is best to illustrate with raw text, not a copy from Splunk's formatted event view.)  So

| rex field=message "Received update request (?<IL_Customer>[^\.]+)\. Size of array: (?<ArraySize>\d+)"

(Also slightly more efficient because the regex engine would be scanning smaller strings.)

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There's probably a JSON-ic way to do that (assuming the event is pure JSON), but rex can handle a few fields nicely.

Assuming the order of fields is fixed, this regex should do it.

 

| rex "Received update request (?<IL_Customer>[^\.]+)\. Size of array: (?<ArraySize>\d+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The values OP is seeking is in the field message. (From the illustration in OP, the event is JSON - but it is best to illustrate with raw text, not a copy from Splunk's formatted event view.)  So

| rex field=message "Received update request (?<IL_Customer>[^\.]+)\. Size of array: (?<ArraySize>\d+)"

(Also slightly more efficient because the regex engine would be scanning smaller strings.)

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...