Splunk Search

Need help in extracting different format of fields

srinivas_gowda
Path Finder

Hello all,

I am extracting a field which is coming in multiple formats, however I found that once of the format is not working as expected. Details below. Please help me in extracting all of these formats without affecting others.

 

Example 1:(highlighted is the field I am trying to extract)

APPLICATION-MIB::evtDevice = STRING: "Server2.Application.APP.INTRANET" APPLICATION-MIB::evtComponent =

 

Example 2:(highlighted is the field I am trying to extract)

APPLICATION-MIB::evtDevice = STRING: "Server1" APPLICATION-MIB::evtComponent =

 

Example 3:(highlighted is the field I am trying to extract)

APPLICATION-MIB::evtDevice = STRING: "SG2-SWMGMT-CAT-001" APPLICATION-MIB::evtComponent =

 

regex used : APPLICATION-MIB::evtDevice\s+=\sSTRING:\s\"(?<source_host>\w+[a-zA-Z0-9-_]\w+)

The above regex is working for both example 1 and 2. However, for example 3 this is working only for the underlined fields and not everything highlighted.

 

Please help in getting this worked.

Labels (4)
0 Karma
1 Solution

javiergn
Super Champion

Hi @srinivas_gowda , I would simply replace your regex with this:

 

APPLICATION-MIB::evtDevice\s+=\sSTRING:\s\"(?<source_host>[\w\-]+)

 

View solution in original post

javiergn
Super Champion

Hi @srinivas_gowda , I would simply replace your regex with this:

 

APPLICATION-MIB::evtDevice\s+=\sSTRING:\s\"(?<source_host>[\w\-]+)

 

Get Updates on the Splunk Community!

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...