Splunk Search

How to extract values from all fields?

senthamilselvan
Engager

Hi Team,
I want to extract the values like left side(LABEL on of the fileds) all fields and values should take from all the logs.

LABEL = SRC_RSTRT , SRC_RSTRS, GBLRESRM_MONITOR_TI
LABEL:          SRC_RSTRT
IDENTIFIER:     CB4A951F

Date/Time:       Fri Sep 29 16:20:02 EDT 2017
Sequence Number: 192161
Machine Id:      00F9FFDD4C00
Node Id:         nc006qad02
Class:           S
Type:            INFO
WPAR:            Global
Resource Name:   SRC             

LABEL:          SRC_RSTRS
IDENTIFIER:     CB4A951F

Date/Time:       Wed Sep 27 06:51:00 EDT 2017
Sequence Number: 192160
Machine Id:      00F9FFDD4C00
Node Id:         nc006qad02
Class:           S
Type:            INFO
WPAR:            Global
Resource Name:   SRC 
LABEL:          GBLRESRM_MONITOR_TI
IDENTIFIER:     87EB4A70

Date/Time:       Mon Sep 25 02:21:03 EDT 2017
Sequence Number: 192159
Machine Id:      00F9FFDD4C00
Node Id:         nc006qad02
Class:           O
Type:            PERM
WPAR:            Global
Resource Name:   GblResRM
0 Karma

493669
Super Champion

hey try this:

<base search>|rex field=_raw "LABEL:\s(?<LABEL>\w+)"

Try this run anywhere search:

|makeresults|eval raw="LABEL: SRC_RSTRT
IDENTIFIER: CB4A951F
Date/Time: Fri Sep 29 16:20:02 EDT 2017
Sequence Number: 192161
Machine Id: 00F9FFDD4C00
Node Id: nc006qad02
Class: S
Type: INFO
WPAR: Global
Resource Name: SRC "|rex field=raw "LABEL:\s(?<LABEL>\w+)"

Hope this helps!

0 Karma

senthamilselvan
Engager

Hi ,
I tried the below search query but still field is not created
index=test sourcetype=errorlog |rex field=raw "LABEL:\s(?\w+)"

0 Karma

493669
Super Champion

instead of raw write _raw

0 Karma

senthamilselvan
Engager

same error for that also.
index=test sourcetype=errorlog |rex field=_raw "LABEL:\s(?\w+)"

Error in 'rex' command: Encountered the following error while compiling the regex 'LABEL:\s(?\w+)': Regex: unrecognized character after (? or (?-

0 Karma

493669
Super Champion

hey have you tried this:

index=test sourcetype=errorlog |rex field=_raw "LABEL:\s(?<LABEL>\w+)"
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...