Splunk Search
Highlighted

How to use rex command to extract this field from my sample log?

Path Finder

Hi ,

COSE#1017 Associated kernel not found. Please see Enterprise Server log for details: SocID:19041 PID:13695 BSFN:CustomShipConfirmWrapper user:AIAINBND

I want to create that highlighted term as a new event field. It may vary in length in following events. Could anyone help me?

Thanks

0 Karma
Highlighted

Re: How to use rex command to extract this field from my sample log?

SplunkTrust
SplunkTrust

Hi Abilan1,

try something like this, which is based on your provided example:

your base search here | rex "\sBSFN:(?<myField>[^\s]*)" | table myField

cheers, MuS

View solution in original post

Highlighted

Re: How to use rex command to extract this field from my sample log?

Path Finder

Thank You MuS!!

0 Karma
Highlighted

Re: How to use rex command to extract this field from my sample log?

SplunkTrust
SplunkTrust

If BSFN is a constant, which it appears to be, something as simple as

 ... | rex "BSFN:(?<GiveMeAName>\w+)"

That says

BSFN: Match the string "BSFN:" (including the colon)

(? Then extract a field named "GiveMeAName"

\w+ Which consists of one or more "word" type characters (letters)

) And finally close off this extraction.

Highlighted

Re: How to use rex command to extract this field from my sample log?

Path Finder

Thank You rich!!! it worked

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.