Splunk Search

Need to extract required fields using rex command

rakesh44
Communicator

Hi Friends

I am trying to extract required field from events using rex command. Can someone please help me, logs are given in attached doc.

I am new to rex command , Once i get below rex command then easy to understand

Below are fields need to extract

Kernel Audit Begin, Kernel Begin,pam_unix Begin,Postfix Begin,-SSHD Begin,Sudo (secure-log) Begin,Disk Space Begin

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi rakesh44,
let mi know: do you want to extract the following fields?

  • TimeStamp
  • Date Range Processed
  • Detail Level of Output
  • Type of Output/Format
  • Logfiles for Host

If these are the fields to extract from the example you shared, try to use the following regex

Processing Initiated: (?<TimeStamp>\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.*Date Range Processed:\s+yesterday\s+\(\s+(?<Date_Range>[^ ]*)\s+.*\s+.*\s+Detail Level of Output:(?<Level_of_input>[^ ]*)\s+Type of Output\/Format:\s+(?<Type>.*)\s*Logfiles for Host: (?<Logfile>[^ ]*)\s+\#

You can test it at https://regex101.com/r/JNMRCz/1

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi rakesh44,
let mi know: do you want to extract the following fields?

  • TimeStamp
  • Date Range Processed
  • Detail Level of Output
  • Type of Output/Format
  • Logfiles for Host

If these are the fields to extract from the example you shared, try to use the following regex

Processing Initiated: (?<TimeStamp>\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.*Date Range Processed:\s+yesterday\s+\(\s+(?<Date_Range>[^ ]*)\s+.*\s+.*\s+Detail Level of Output:(?<Level_of_input>[^ ]*)\s+Type of Output\/Format:\s+(?<Type>.*)\s*Logfiles for Host: (?<Logfile>[^ ]*)\s+\#

You can test it at https://regex101.com/r/JNMRCz/1

Bye.
Giuseppe

0 Karma

rakesh44
Communicator

Thanks Gcusello , it worked for me rest I would create it

Processing Initiated: (?\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.Date Range Processed:\s+yesterday\s+(\s+(?[^ ])\s+.\s+.\s+Detail Level of Output:(?[^ ])\s+Type of Output\/Format:\s+(?.)\s*Logfiles for Host: (?[^ ]*)\s+#

0 Karma

gcusello
SplunkTrust
SplunkTrust

Good!
if you're satisfied of this answer, please accept and/or upvote it.
At the next time.
Bye.
Giuseppe

0 Karma

vishaltaneja070
Motivator

can you give me the sample value of extraction required for Kernel Audit Begin?

0 Karma

rakesh44
Communicator

I have to prepare dashboard for each field as mentioned, hence need all values of fields.
Kernel Audit Begin : Nee all values of field

0 Karma

rakesh44
Communicator

Unmatched Entries (Only first 100 out of 127 are printed)
dispatch err (pipe full) event lost
dispatch error reporting limit reached - ending report notification.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...