Splunk Search

How to parse specific value from a field value?

wicke_s
Explorer

Disclaimer : I'm new to Regex and using the Rex function

I have a field "Message" that has the following string format:

"EWT_Print=282, CIQ=1, Did not meet the threshold, 009s5td"

All the Message field values are going to have the same format "EWT_Print=[some number], CIQ=[some number], some text"

I am trying to extract the value of the EWT_Print, in this example 282 and display it in a table, however, I always get an empty table when I try this:

<my base search> | rex field=Message "EWT_Print=(?<EWT>[0-9]+)*"

What am I doing wrong?

0 Karma
1 Solution

jnudell_2
Builder

Try:

... [ your search ] ... 
| rex "EWT_Print=(?<EWT>[^,]+),"

If that works, then try:

... [ your search ] ... 
| rex field=Message "EWT_Print=(?<EWT>[^,]+),"

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

@wicke_s - Try this regex. (make sure field Message is not containing "(quote) in value.)

^EWT_Print=(?<EWT_Printer>\d+),
0 Karma

pranay_adla
Explorer
  <base search> | rex field=Message "EWT_Print\=(?P<EWT>\d+)\,"
0 Karma

vnravikumar
Champion

Hi

Try this,

| makeresults 
| eval Message = "EWT_Print=282, CIQ=1, Did not meet the threshold, 009s5td" 
| rex field=Message "EWT_Print\=(?P<EWT>[\d]+)"
0 Karma

jnudell_2
Builder

Try:

... [ your search ] ... 
| rex "EWT_Print=(?<EWT>[^,]+),"

If that works, then try:

... [ your search ] ... 
| rex field=Message "EWT_Print=(?<EWT>[^,]+),"

wicke_s
Explorer

This did the trick, The ',' is what I was missing.....

<search> | rex "EWT_Print=(?<EWT>[0-9]+)," 

is the query that worked for me. Thanks a lot

0 Karma

jkat54
SplunkTrust
SplunkTrust

Are you searching in verbose mode? Because verbose mode auto extracts key value pairs like these you have.

If not in verbose mode you can use the '| extract' command to achieve the same result.

0 Karma

wicke_s
Explorer

Thanks for your reply! I am searching in verbose mode and I also tried the search with the "extract" keyword. Still returns empty table

0 Karma

jkat54
SplunkTrust
SplunkTrust

What's your full search?

0 Karma

wicke_s
Explorer
index=<index> sourcetype=<sourcetype> Message="EWT_Print*" | rex field=Extended_Field.Message "EWT_Print=(?<EWT>[0-9]+)"| table EWT
0 Karma

jkat54
SplunkTrust
SplunkTrust

Try renaming the field first
...
| rename Extended_Field.Message as message
| rex field=message
...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your regex looks good, although the * is not needed. It works in regex101.com. Have you tried without the *?

---
If this reply helps you, Karma would be appreciated.
0 Karma

wicke_s
Explorer

Yes, I got the regex from regex101.com 🙂

I tried without the * and it still doesn't work. I tried without the table and I could see I have at least 133 events matching the search, however the rex still doesn't work.

Thanks for taking the time to look into this!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...