Splunk Search

How to use rex to extract the very next word in a search?

Akumar294
Path Finder

Good Day,

I would like to extract a new field called "Status" and the values for this field will be the text right after "status changed to".
For example - Completed, Waiting,Launched,Active.
Is this regex good match?- (Completed|Launched|Active|Waiting), but how to write this in splunk so that it creates a new field called status?

I have data in below form:

310822856,"09/19/2018
02:31:30
PM","Job ""DMS_05_BosLog_Files [88]"" status change to Completed Normally.",Audit,Job Manager,1100,DMS_05_Outbound_Files,88,Production
310822857,"09/19/2018
02:31:30
PM","Job ""02_DMS_BSTORE [89]"" status change to Completed Normally.",Audit,Job Manager,1100,02_DMS_EOD_LOG_ZSTORE,89,
310822848,"09/19/2018
02:31:29
PM","Job ""DFMS_05__Outbound_Files [90]"" status change to Launched.",Audit,Job Manager,1100,DMS_05_Outbound_Files,90,Production
22855,"09/19/2018
02:31:29
PM","Job ""DMS_05_Archive_PosLog_Outbound_Files [91]"" status change to Active",Audit,Job Manager,1100,DMS_05_Outbound_Files,10317045,Production
22840,"09/19/2018
02:31:28
PM","Job ""DMS_05_Archive_PosLog_Outbound_Files [91]"" status change to Waiting On Resource",Audit,Job Manager,1100,DMS_05_Outbound_Files,7045,Production

Note : I am running splunk Cloud

0 Karma
1 Solution

493669
Super Champion

Hi @Akumar,
try this:

...|rex  "status change to (?<status>\w+)"

this will create new field status and store extracted value

View solution in original post

0 Karma

493669
Super Champion

Hi @Akumar,
try this:

...|rex  "status change to (?<status>\w+)"

this will create new field status and store extracted value

0 Karma

Akumar294
Path Finder

Hi Rajesh,

I have tried what you have suggested, but seems like it did not worked out(No fields were extracted)
Probably you can ingest my given few sample data and see if it works?
Please let me know for any further questions.

Thanks,
Ankit

0 Karma

493669
Super Champion

I tried below and its working for me-

|makeresults|eval DB="310822856,\"09/19/2018
02:31:30
PM\",\"Job \"\"DMS_05_BosLog_Files [88]\"\" status change to Completed Normally.\",Audit,Job Manager,1100,DMS_05_Outbound_Files,88,Production
310822857,\"09/19/2018
02:31:30
PM\",\"Job \"\"02_DMS_BSTORE [89]\"\" status change to Completed Normally.\",Audit,Job Manager,1100,02_DMS_EOD_LOG_ZSTORE,89,
310822848,\"09/19/2018
02:31:29
PM\",\"Job \"\"DFMS_05__Outbound_Files [90]\"\" status change to Launched.\",Audit,Job Manager,1100,DMS_05_Outbound_Files,90,Production
22855"|rex max_match=0 field=DB "status change to (?<status>\w+)"
0 Karma

Akumar294
Path Finder

Thanks a lot Rajesh, it worked!!(There was a minor mistake on my end).
Really appreciate your help.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...