Splunk Search

How to fetch the values from log using regular expression?

aqaadi
Engager

Hi Team,

Need your help on below search:

I'm spitting something like this in the log:

My Test Data|My Test ID|My Case Status|My verification code|My Comments on case

The log has the data similar to above format delimited by pipe "|"

I have around 8 fields in this way and I want to extract them in a table format and send the output to a service.

Can you help me achieve it?

0 Karma

aqaadi
Engager

I tried the regex expression regex _raw=(ML\D{17})|(\D{3}\d{6}-\d{6}) and it worked. However i see entire log snippet is being returned instead of just the data present in regex expression.

Any idea how to achieve this?

0 Karma

vnravikumar
Champion

Hi

Try like

| makeresults 
| eval test="aaa|bbb|ccc|ddd|eee" 
| eval result=split(test,"|") 
| eval My_Test_Data=mvindex(result,0),My_Test_ID=mvindex(result,1),My_Case_Status=mvindex(result,2),My_verification_code=mvindex(result,3),My_Comments_on_case=mvindex(result,4) 
| table My_Test_Data My_Test_ID My_Case_Status My_verification_code My_Comments_on_case

aqaadi
Engager

This worked thanks

0 Karma

aqaadi
Engager

what should be the value of makeresults here ?

0 Karma

aqaadi
Engager

thanks let me try it.
How do i passs the log snippet at runtime to test variable?

0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...