Splunk Search

How to use rex to extract from logs.

avi7326
Path Finder

I want to  extract that BID@ from the  log. and for other logs the external ID will be different so what will be the regular expression to get this in the table.

 

[-]
   
loggerorg.mule.service.http.impl.service.HttpMessageLogger.bmw-crm-wh-xl-gcdm-api-httpListenerConfig
   
messageLISTENER POST /api/v1/leads HTTP/1.1 X-SSL-Client-Verify: NONE Host: crm-il-api-prod.bmwgroup.com X-Real-IP: 35.242.211.49 X-Forwarded-For: 3.64.37.232, 35.242.211.49 X-Forwarded-Proto-Real: https Content-Length: 8796 X-Forwarded-Port: 443 X-Forwarded-Proto: https Content-type: application/json Accept: application/json X-c2b-External-Id: BID@1686598556eIiVYNd6BnktQwdOVCO User-Agent: Apache-HttpClient/4.5.13 (Java/1.8.0_341) Accept-Encoding: gzip,deflate x-c2b-request-id: rrt-6355934869680509287-c-geu3-17546-27196975-4 X-c2b-clientId: bmwdigital X-c2b-clientVariantId: DE-de Authorization: Basic SUxfR0NETV9QUkQ6dkZGczNpQk5OeVVFcVBWUzJ0NWJEdmQ4N1JGcEt4d2ZrYnJzbzZxdG81 

 

Labels (2)
0 Karma
1 Solution

Thulasinathan_M
Contributor

This pattern will get you all the Id's and it'll be stored in BID field, so you can do a | table BID.

[\s\S]+External-Id: BID@(?<BID>[^\s]+)

View solution in original post

Thulasinathan_M
Contributor

This pattern will get you all the Id's and it'll be stored in BID field, so you can do a | table BID.

[\s\S]+External-Id: BID@(?<BID>[^\s]+)

Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...