Splunk Search

How to search and extract a string of text as a new field?

shrirangphadke
Path Finder

Hi,

I want to search for a particular text, for example:

"Error.*CP:Link Change: Received Link UP for already active instance"'

and extract it as a field. That means I want to add this field as:

inst_Error="Error.*CP:Link Change: Received Link UP for already active instance"' 

in Splunk.

So now using inst_error, I want to form a search string as:

if severity=critical AND inst_error exists

Please help.

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi shrirangphadke,

okay, I'll try it ....

your base search here to get the needed events | rex field=_raw "(?<inst_Error>Error\.\*CP.+)\"" | eval inst_Error=if(isnull(inst_Error), "null", inst_Error) | search severity=critical AND inst_error!="null"

This is un-tested since you did not provide any of your real world events.
But this will get you started....

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi shrirangphadke,

okay, I'll try it ....

your base search here to get the needed events | rex field=_raw "(?<inst_Error>Error\.\*CP.+)\"" | eval inst_Error=if(isnull(inst_Error), "null", inst_Error) | search severity=critical AND inst_error!="null"

This is un-tested since you did not provide any of your real world events.
But this will get you started....

cheers, MuS

shrirangphadke
Path Finder

Thank you very much for answer, indeed it solved my problem, Thanks !

0 Karma

shrirangphadke
Path Finder

Thanks ! @ppablo_splunk

0 Karma

ppablo
Retired

You're welcome @shrirangphadke 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...