Splunk Search

Need to extract JSESSIONID from result

rh417692
Path Finder

Query: index="prod" "Null Pointer Exception"
Result: Key: value, key; value, JSESSIONID:123456.ATG.PROD, key: value

How do I extract only the JSESSIONID from the result?

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index="prod" "Null Pointer Exception" | rex "JSESSIONID\:(?<JSESSIONID>[^\.]+)"

View solution in original post

somesoni2
Revered Legend

Try this

index="prod" "Null Pointer Exception" | rex "JSESSIONID\:(?<JSESSIONID>[^\.]+)"

rh417692
Path Finder

Is there a way to capture unique JSESSIONID values?

0 Karma

somesoni2
Revered Legend

Do you mean your search result should show one event per JSESSIONID? If yes, then use like this

index="prod" "Null Pointer Exception" | rex "JSESSIONID\:(?<JSESSIONID>[^\.]+)" | dedup JSESSIONID
0 Karma

rh417692
Path Finder

The 'dedup JSESSIONID' got me unique JSESSIONID values. Thank you @somesoni2 !

0 Karma

rh417692
Path Finder

Do you mind explaining this part please: "JSESSIONID:(?[^.]+)" ? Does it mean to capture the value after the colon? If yes, and if there was a space after colon, would it have captured that too? How would you ignore the space after the colon?

0 Karma

somesoni2
Revered Legend

It's basically everything between JSESSIONID: and first occurance of dot. It would capture that space as well. To ignore that try this. This will ignore space if present after colon (0 or more occurance of space)

| rex "JSESSIONID\:\s*(?<JSESSIONID>[^\.]+)"
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...