Splunk Search

How to get 2 values out of a string using rex command

rilee
Explorer

I have the following sample data returned that I'd like to extract 2 fields out of it: 1) The value after the "T "  and before the "EmployeeController.Post -" will be the first field <tsid>.   2) Between the "EmployeeController.Post - " and " - End" will be the second field <duration>.  

06/30/21 09:39:21.39 p17872 [00226] T ELBJsZX6wk68nXrUKKEd4g EmployeeController.Post - 00:00:00:538 - End
 
Your help is highly appreciated.
 

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is very straightforward so I'm interested in seeing what you've tried and help determine why it didn't work.

At search time, this can be done with two separate regexes:

| rex "] T (?<tsid>\S+)"
| rex "EmployeeController.Post - (?<duration>\S+)"

or with a single regex:

| rex "] T (?<tsid>\S+) EmployeeController.Post - (?<duration>\S+)"

At index-time, use the latter regex.

---
If this reply helps you, Karma would be appreciated.

rilee
Explorer

In my base index search, I added  "EmployeeController.Post" "- End" filter values to return only the lines I need.

Then I used 

| rex field=_raw "\s+T+\s(?<txid>.*?)\s+EmployeeController\\.Post\s\\-\s(?<duration>.*?)\s\\-\s+End"

|table txid duration

That did work and I have solved my issue just an hour ago! 

But yours looks much neater.  Thank you so much for your reply.  I appreciate it.  Practice makes perfection and I shall get better sooner than later.

Tags (1)
0 Karma

rilee
Explorer

Sorry, tsid and txid are the same I am referring to. ^_^ I will refine my syntax to use your line. Thanks again 

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...