Splunk Search

How to use rex to extract the very next word in a search?

Akumar294
Path Finder

Good Day,

I would like to extract a new field called "Status" and the values for this field will be the text right after "status changed to".
For example - Completed, Waiting,Launched,Active.
Is this regex good match?- (Completed|Launched|Active|Waiting), but how to write this in splunk so that it creates a new field called status?

I have data in below form:

310822856,"09/19/2018
02:31:30
PM","Job ""DMS_05_BosLog_Files [88]"" status change to Completed Normally.",Audit,Job Manager,1100,DMS_05_Outbound_Files,88,Production
310822857,"09/19/2018
02:31:30
PM","Job ""02_DMS_BSTORE [89]"" status change to Completed Normally.",Audit,Job Manager,1100,02_DMS_EOD_LOG_ZSTORE,89,
310822848,"09/19/2018
02:31:29
PM","Job ""DFMS_05__Outbound_Files [90]"" status change to Launched.",Audit,Job Manager,1100,DMS_05_Outbound_Files,90,Production
22855,"09/19/2018
02:31:29
PM","Job ""DMS_05_Archive_PosLog_Outbound_Files [91]"" status change to Active",Audit,Job Manager,1100,DMS_05_Outbound_Files,10317045,Production
22840,"09/19/2018
02:31:28
PM","Job ""DMS_05_Archive_PosLog_Outbound_Files [91]"" status change to Waiting On Resource",Audit,Job Manager,1100,DMS_05_Outbound_Files,7045,Production

Note : I am running splunk Cloud

0 Karma
1 Solution

493669
Super Champion

Hi @Akumar,
try this:

...|rex  "status change to (?<status>\w+)"

this will create new field status and store extracted value

View solution in original post

0 Karma

493669
Super Champion

Hi @Akumar,
try this:

...|rex  "status change to (?<status>\w+)"

this will create new field status and store extracted value

0 Karma

Akumar294
Path Finder

Hi Rajesh,

I have tried what you have suggested, but seems like it did not worked out(No fields were extracted)
Probably you can ingest my given few sample data and see if it works?
Please let me know for any further questions.

Thanks,
Ankit

0 Karma

493669
Super Champion

I tried below and its working for me-

|makeresults|eval DB="310822856,\"09/19/2018
02:31:30
PM\",\"Job \"\"DMS_05_BosLog_Files [88]\"\" status change to Completed Normally.\",Audit,Job Manager,1100,DMS_05_Outbound_Files,88,Production
310822857,\"09/19/2018
02:31:30
PM\",\"Job \"\"02_DMS_BSTORE [89]\"\" status change to Completed Normally.\",Audit,Job Manager,1100,02_DMS_EOD_LOG_ZSTORE,89,
310822848,\"09/19/2018
02:31:29
PM\",\"Job \"\"DFMS_05__Outbound_Files [90]\"\" status change to Launched.\",Audit,Job Manager,1100,DMS_05_Outbound_Files,90,Production
22855"|rex max_match=0 field=DB "status change to (?<status>\w+)"
0 Karma

Akumar294
Path Finder

Thanks a lot Rajesh, it worked!!(There was a minor mistake on my end).
Really appreciate your help.

0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...