Splunk Search

How to extract using rex

avi7326
Path Finder

[-]
   
loggerorg.mule.runtime.core.internal.processor.LoggerMessageProcessor
   
messageReceived update request IL_Customer. Size of array: 1
   
properties: { [-]
     
correlationId4b910aaf-d316-4594-8eda-c56e861499d3
     

I want to extract the IL_customer and array size from the above log. What will be the regular expression.

Thanks in Advance

 

Labels (1)
Tags (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

The values OP is seeking is in the field message. (From the illustration in OP, the event is JSON - but it is best to illustrate with raw text, not a copy from Splunk's formatted event view.)  So

| rex field=message "Received update request (?<IL_Customer>[^\.]+)\. Size of array: (?<ArraySize>\d+)"

(Also slightly more efficient because the regex engine would be scanning smaller strings.)

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There's probably a JSON-ic way to do that (assuming the event is pure JSON), but rex can handle a few fields nicely.

Assuming the order of fields is fixed, this regex should do it.

 

| rex "Received update request (?<IL_Customer>[^\.]+)\. Size of array: (?<ArraySize>\d+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The values OP is seeking is in the field message. (From the illustration in OP, the event is JSON - but it is best to illustrate with raw text, not a copy from Splunk's formatted event view.)  So

| rex field=message "Received update request (?<IL_Customer>[^\.]+)\. Size of array: (?<ArraySize>\d+)"

(Also slightly more efficient because the regex engine would be scanning smaller strings.)

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...