Splunk Search

Need help in extraction

srinivas_gowda
Path Finder

Hello team, 

 

I am facing an issue while trying to extract the below events. Please help in this.

 

Event:

150022 High 2021.11.22 03:32:44 App Proxy: Utilization of preprocessing manager processes over 80% prd-Server06 1.2.3.4 Utilization of preprocessing manager internal processes, in % 100 %

 

Extraction used:

^(?:[^:\n]*:){2}\d+\s+(?P<field1>[^\t]+)(?:[^\.\n]*\.){3}\d+\s+(?P<field2>[^ ]+)(?:[^ \n]* ){7}\%\s(?P<field3>.+)

 

Although all other fields are extracted as expected. The field2 is unable to extract the highlighted/underlined field. Please let me know how I may fix the field2 here.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You had a misplaced closing bracket for the field2 pattern

^(?:[^:\n]*:){2}\d+\s+(?P<field1>[^\t]+)(?:[^\.\n]*\.){3}\d+\s+(?P<field2>[^ ]+(?:[^ \n]* ){7})\%\s(?P<field3>.+)

View solution in original post

srinivas_gowda
Path Finder

By using this, the Source from the below event is not being extracted. I am looking at something that can work on all extractions. The highlighted is the source from the event.

 

564574 High 2021.11.29 09:17:44 KOBE1024-S-06F-HUB01 has been restarted (uptime < 10m) KOBE1024-S-06F-HUB01 10.227.1.221 Uptime 00:00:51

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you give examples of all the different sorts of events you want to extract fields from and highlight using different colours which parts belong to which belong to which fields using the same colour for the same field?

The two examples given so far differ in that the second one does not have % in which is used in the first pattern to anchor the field. Unless they have common anchors across all events, you may not be able to extract from all the events with a common expression.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You had a misplaced closing bracket for the field2 pattern

^(?:[^:\n]*:){2}\d+\s+(?P<field1>[^\t]+)(?:[^\.\n]*\.){3}\d+\s+(?P<field2>[^ ]+(?:[^ \n]* ){7})\%\s(?P<field3>.+)
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...