Splunk Search

How to make a field extraction for my sample data?

ewise1
New Member

I want to make a field extraction by the name of Action to show this whole text ,'update ggsourceadmin.monitor set ORACLE_TIME = CURRENT_TIMESTAMP WHERE TABLE_PK = 1',; how should I extract?

0 Karma

woodcock
Esteemed Legend

You need to show us the entire raw event.

0 Karma

DalJeanis
Legend

You would have to show us the surrounding text, or examples of different versions, for us to know what to focus on in building the regex.

One thing that I would check on is whether that whole SQL statement ended in a semicolon. If so, that makes it pretty easy to know when to stop. Assuming there is one, then this rex would do it.

| rex "(i)(?update [^;]+;)"

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...