Splunk Search

How to use rex to extract a named field within a named field?

jpaulovich
Explorer

Greetings, The event that I'm working with is below. The problem is that our platform (in this case) has a field called 'parm', which Splunk extracts. However, I need to extract the field as 'mobileNetworkCode' with the associated values. Sadly, my efforts to accomplish this using rex have not been successful. The part that I'm having trouble with is properly extracting the field values (260 in this example). Any assistance is certainly appreciated.

​MobileApi.1.tue:1018 23:01:31.87: [MobileApiThread1]  >> tan_lookup3_q handle=33 contextid=aab81b0d1fb8969 sessionid=0 classid=14072 ani=NNNNNNNNNNN method=8 type=1 lock_time=60 map_time=60 svc_id=5718352036 controlNumber=4435209740 dn=+NNNNNNNNNNN rawdn=+NNNNNNNNNNN aniBlocked= otg=AND-TANSPA_X sctype=1 cac= isCustServ=false locked=false callAni=NNNNNNNNNN country=US callsetupid=0a1823013187aac **parm=mobileNetworkCode=260** mobileCountryCode=310 mobileCarrierName=XXXXXXXX
0 Karma
1 Solution

JDukeSplunk
Builder

It might be overkill, but something like this might get it. Try this in a search

..youbase search |rex field=_raw "(?i)parm=mobileNetworkCode=(?P<NEWFEILDNAME>\d+)"

Assuming this line is always formatted like this, and is alwasy a number.

View solution in original post

jpaulovich
Explorer

These both worked fine. I was curious about runDuration ...
Surprisingly, "rex field=parm "=(?[\S]+)" ran for 5.112s, while
rex field=_raw "(?i)parm=mobileNetworkCode=(?P\d+) ran for 4.449s. I would have thought the rex using the specific field would have been quicker. In this case though, it's only an academic point.
Thank you very much for your excellent, expeditious explanations 🙂

One other (quick?) question (related to this search)...
Splunk is chopping a specific field value at the & (ampersand), i.e. ABCXYZ&123456, and returns only ABCXYZ. How can I coax Splunk to return the entire field contents, which includes the &?

0 Karma

JDukeSplunk
Builder

It might be overkill, but something like this might get it. Try this in a search

..youbase search |rex field=_raw "(?i)parm=mobileNetworkCode=(?P<NEWFEILDNAME>\d+)"

Assuming this line is always formatted like this, and is alwasy a number.

gokadroid
Motivator

Try this if parm is already extracted field with value "xxxx=yyyy", below will get you yyyy:

yourBaseSearchThatExtracts parm
| rex field=parm "\=(?<parmValue>[\S]+)"
| use your parmValue here

UPDATED If you want to extract the key as well:

yourBaseSearchThatExtracts parm
|rex field=parm "(?<parmKey>[^\=]+)\=(?<parmValue>[^\s]+)"| table parmKey, parmValue
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...