How to search and extract a string of text as a new field?

[shrirangphadke]

Hi,

I want to search for a particular text, for example:

"Error.*CP:Link Change: Received Link UP for already active instance"'

and extract it as a field. That means I want to add this field as:

inst_Error="Error.*CP:Link Change: Received Link UP for already active instance"' 

in Splunk.

So now using inst_error, I want to form a search string as:

if severity=critical AND inst_error exists

Please help.

[MuS · Accepted solution]

Hi shrirangphadke,

okay, I'll try it ....

your base search here to get the needed events | rex field=_raw "(?<inst_Error>Error\.\*CP.+)\"" | eval inst_Error=if(isnull(inst_Error), "null", inst_Error) | search severity=critical AND inst_error!="null"

This is un-tested since you did not provide any of your real world events.
But this will get you started....

cheers, MuS

[shrirangphadke]

Thank you very much for answer, indeed it solved my problem, Thanks !

[shrirangphadke]

Thanks ! @ppablo_splunk

[ppablo]

You're welcome @shrirangphadke 🙂