Splunk Search

How to get 2 values out of a string using rex command

rilee
Explorer

I have the following sample data returned that I'd like to extract 2 fields out of it: 1) The value after the "T "  and before the "EmployeeController.Post -" will be the first field <tsid>.   2) Between the "EmployeeController.Post - " and " - End" will be the second field <duration>.  

06/30/21 09:39:21.39 p17872 [00226] T ELBJsZX6wk68nXrUKKEd4g EmployeeController.Post - 00:00:00:538 - End
 
Your help is highly appreciated.
 

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is very straightforward so I'm interested in seeing what you've tried and help determine why it didn't work.

At search time, this can be done with two separate regexes:

| rex "] T (?<tsid>\S+)"
| rex "EmployeeController.Post - (?<duration>\S+)"

or with a single regex:

| rex "] T (?<tsid>\S+) EmployeeController.Post - (?<duration>\S+)"

At index-time, use the latter regex.

---
If this reply helps you, Karma would be appreciated.

rilee
Explorer

In my base index search, I added  "EmployeeController.Post" "- End" filter values to return only the lines I need.

Then I used 

| rex field=_raw "\s+T+\s(?<txid>.*?)\s+EmployeeController\\.Post\s\\-\s(?<duration>.*?)\s\\-\s+End"

|table txid duration

That did work and I have solved my issue just an hour ago! 

But yours looks much neater.  Thank you so much for your reply.  I appreciate it.  Practice makes perfection and I shall get better sooner than later.

Tags (1)
0 Karma

rilee
Explorer

Sorry, tsid and txid are the same I am referring to. ^_^ I will refine my syntax to use your line. Thanks again 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...