How to write Splunk query to extract a field from raw data?

[rajs115]

Hi,

  I am trying to find a query to extract specific code from the raw splunk data. Below is the raw content.

raw:

[demo] FATAL com.test.data - ***** Major issue error: xyz: Completion Code '1', Reason '111'

I need to extract the data "Major issue error:xyz". Please help to me extract it.

Thanks,

Raj.

[LRF · Accepted solution]

Hi @rajs115 ,

Not knowing how the complete patterns of the reported logs is, the following regex can be used as a template:

<your base search here> |rex field=_raw "(?<majorIssue>Major issue error:.*):\s"

 regex will be applied on the _raw field to capture everything specified in the capturing group and will be extracted in a new field called majorIssue

Sample Result:

_raw	_time	majorIssue
[demo] FATAL com.test.data - ***** Major issue error: xyz: Completion Code '1', Reason '111'	2023-03-29 19:40:49	Major issue error: xyz

Sample Spl query:

|makeresults |eval _raw="[demo] FATAL com.test.data - ***** Major issue error: xyz: Completion Code '1', Reason '111'" |rex field=_raw "(?<majorIssue>Major issue error:.*):\s"

Hope this will help you, have a nice day!

Fabrizio 

[rajs115]

hi @LRF , thanks for your response. it worked