Splunk Search

How to get fields extracted by two fields?

kc_prane
Path Finder

 i need  the fields  extracted  by two fields 

1) Detail message  = before the comma ( I need the full description)

2) Count =  after the comma ( I need the digit count)

RAW Log starts from below :

DETAIL MESSAGE, COUNT

Index 0 out of bounds for length 0, 61

No Recipienet found in MDM based on the input parameters, 120

No record found with this document Id, 86

No Records Found with given search Criteria in DB, 52

query did not return a unique result: 2; nested exception is javax.persistence.NonUniqueResultException: query did not return a unique result: 2, 106

You do not currently manage any user roles in PERLSS there is no task data to display at this time, 96

Labels (2)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It was not clear from the OP that the sample data was a single event rather than multiple events.  That means the regular expression matches multiple strings, but the rex command defaults to returning only the first.  Use the max_match option to override that.

 

 

| rex max_match=0 "(?<detailMessage>[^,]+), (?<count>\d+)"

 

 

This will produce multi-value fields. You'll then need to use mv commands/functions to work with the fields.

Let us know what results you want and we can try to be more specific.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should get you started

| rex "(?<detailMessage>[^,]+), (?<count>\d+)"
---
If this reply helps you, Karma would be appreciated.
0 Karma

kc_prane
Path Finder

Thanks, @richgalloway. But here I am only getting the first line for the fields extracted  in the log

 

kc_prane_0-1647023504759.png

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You say you only get one line, but the screenshot shows 7 lines.

Please provide more information, including the query used and the props.conf settings for the sourcetype.

---
If this reply helps you, Karma would be appreciated.
0 Karma

kc_prane
Path Finder

 

Hi @richgalloway   I don't have much details of the props but the below screenshot shows the rex is working only for the first line.

kc_prane_0-1647028953208.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It was not clear from the OP that the sample data was a single event rather than multiple events.  That means the regular expression matches multiple strings, but the rex command defaults to returning only the first.  Use the max_match option to override that.

 

 

| rex max_match=0 "(?<detailMessage>[^,]+), (?<count>\d+)"

 

 

This will produce multi-value fields. You'll then need to use mv commands/functions to work with the fields.

Let us know what results you want and we can try to be more specific.

---
If this reply helps you, Karma would be appreciated.
0 Karma

kc_prane
Path Finder

Much appreciated mate for your help!. It worked for me.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...