Splunk Search

Need help in extracting different format of fields

srinivas_gowda
Path Finder

Hello all,

I am extracting a field which is coming in multiple formats, however I found that once of the format is not working as expected. Details below. Please help me in extracting all of these formats without affecting others.

 

Example 1:(highlighted is the field I am trying to extract)

APPLICATION-MIB::evtDevice = STRING: "Server2.Application.APP.INTRANET" APPLICATION-MIB::evtComponent =

 

Example 2:(highlighted is the field I am trying to extract)

APPLICATION-MIB::evtDevice = STRING: "Server1" APPLICATION-MIB::evtComponent =

 

Example 3:(highlighted is the field I am trying to extract)

APPLICATION-MIB::evtDevice = STRING: "SG2-SWMGMT-CAT-001" APPLICATION-MIB::evtComponent =

 

regex used : APPLICATION-MIB::evtDevice\s+=\sSTRING:\s\"(?<source_host>\w+[a-zA-Z0-9-_]\w+)

The above regex is working for both example 1 and 2. However, for example 3 this is working only for the underlined fields and not everything highlighted.

 

Please help in getting this worked.

Labels (4)
0 Karma
1 Solution

javiergn
Super Champion

Hi @srinivas_gowda , I would simply replace your regex with this:

 

APPLICATION-MIB::evtDevice\s+=\sSTRING:\s\"(?<source_host>[\w\-]+)

 

View solution in original post

javiergn
Super Champion

Hi @srinivas_gowda , I would simply replace your regex with this:

 

APPLICATION-MIB::evtDevice\s+=\sSTRING:\s\"(?<source_host>[\w\-]+)

 

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...