Splunk Search

How to write a Regular Expression to extract these values from my sample data into new fields?

namritha
Path Finder

Hi,
I have an application that calls other external applications/systems. I wish to plot the calls to external systems per server.
My log files look like this,

alt text

I have managed to extract a separate field, calls to external systems i.e. the value highlighted above. I need to further extract other values from this field. What I need is stated below,

alt text

**

Can you please tell me the rex command to be used?

**

NOTE: All values used in this question are dummy placeholders, and are not original configurations.

Thanks in advance.

0 Karma
1 Solution

sundareshr
Legend

I don't think you can get all scenarios in one regex. You may be better off (reliability wise) creating separate regex. Something like this

... | rex field=fieldextractedfromraw "(?<addtional_info>http.*)\/" | rex field=fieldextractedfromraw "Client invoked\s(?<addtional_info>.*)"  | eval additonal_info=coalesce(additional_info, fieldextractedfromraw)

View solution in original post

sundareshr
Legend

I don't think you can get all scenarios in one regex. You may be better off (reliability wise) creating separate regex. Something like this

... | rex field=fieldextractedfromraw "(?<addtional_info>http.*)\/" | rex field=fieldextractedfromraw "Client invoked\s(?<addtional_info>.*)"  | eval additonal_info=coalesce(additional_info, fieldextractedfromraw)

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!