Splunk Search

How to parse specific value from a field value?

Explorer

Disclaimer : I'm new to Regex and using the Rex function

I have a field "Message" that has the following string format:

"EWT_Print=282, CIQ=1, Did not meet the threshold, 009s5td"

All the Message field values are going to have the same format "EWT_Print=[some number], CIQ=[some number], some text"

I am trying to extract the value of the EWT_Print, in this example 282 and display it in a table, however, I always get an empty table when I try this:

<my base search> | rex field=Message "EWT_Print=(?<EWT>[0-9]+)*"

What am I doing wrong?

0 Karma
1 Solution

Builder

Try:

... [ your search ] ... 
| rex "EWT_Print=(?<EWT>[^,]+),"

If that works, then try:

... [ your search ] ... 
| rex field=Message "EWT_Print=(?<EWT>[^,]+),"

View solution in original post

Motivator

@wicke_s - Try this regex. (make sure field Message is not containing "(quote) in value.)

^EWT_Print=(?<EWT_Printer>\d+),
0 Karma

New Member
  <base search> | rex field=Message "EWT_Print\=(?P<EWT>\d+)\,"
0 Karma

Champion

Hi

Try this,

| makeresults 
| eval Message = "EWT_Print=282, CIQ=1, Did not meet the threshold, 009s5td" 
| rex field=Message "EWT_Print\=(?P<EWT>[\d]+)"
0 Karma

Builder

Try:

... [ your search ] ... 
| rex "EWT_Print=(?<EWT>[^,]+),"

If that works, then try:

... [ your search ] ... 
| rex field=Message "EWT_Print=(?<EWT>[^,]+),"

View solution in original post

Explorer

This did the trick, The ',' is what I was missing.....

<search> | rex "EWT_Print=(?<EWT>[0-9]+)," 

is the query that worked for me. Thanks a lot

0 Karma

SplunkTrust
SplunkTrust

Are you searching in verbose mode? Because verbose mode auto extracts key value pairs like these you have.

If not in verbose mode you can use the '| extract' command to achieve the same result.

0 Karma

Explorer

Thanks for your reply! I am searching in verbose mode and I also tried the search with the "extract" keyword. Still returns empty table

0 Karma

SplunkTrust
SplunkTrust

What's your full search?

0 Karma

Explorer
index=<index> sourcetype=<sourcetype> Message="EWT_Print*" | rex field=Extended_Field.Message "EWT_Print=(?<EWT>[0-9]+)"| table EWT
0 Karma

SplunkTrust
SplunkTrust

Try renaming the field first
...
| rename Extended_Field.Message as message
| rex field=message
...

0 Karma

SplunkTrust
SplunkTrust

Your regex looks good, although the * is not needed. It works in regex101.com. Have you tried without the *?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Yes, I got the regex from regex101.com 🙂

I tried without the * and it still doesn't work. I tried without the table and I could see I have at least 133 events matching the search, however the rex still doesn't work.

Thanks for taking the time to look into this!

0 Karma