Splunk Search

Query regarding splunk field extraction

p_basanth
New Member

Using the below regex I was able to extract first7 fields
Need to extract the last 3 fields
How to skip the blank <> <> tags and continue?

Sample Event:

####(DateTime) (Info) (Health) (host.domain.name) (component1) (component2) ((anonymous)) () () (1363678659879) (BEA-310002) (54% of the total memory in the server is free)

The original event has angular braces <> as the field delimiter above. Due to browser compatibility i have changed them to normal braces()

Regex working fine (first 7 fields):
####<(?P< F1>[^>]+)> \s+<(?P[^>]+)>\s+<(?P[^>]+)>\s+<(?P[^.]+)[^<\n]<(?P[^>]+)>\s+<(?P[^>]+)>\s+<(?P[^>]+>)>


Below regex not working (after 7th field):
####<(?P< FIELDNAME1>[^>]+)> \s+<(?P[^>]+)>\s+<(?P[^>]+)>\s+<(?P[^.]+)[^<\n]<(?P[^>]+)>\s+<(?P[^>]+)>\s+<(?P[^>]+>)>[^>\n]>\s[^>\n]>\s+<(?P[^>]+)>\s+<(?P[^>]+)>\s+<(?P[^>]+)>

Tags (2)
0 Karma

datasearchninja
Communicator

You need to change the '+' to a '*' in any field that can be empty.

e.g:
[^>]+ must match at least one character that is not '>'
[^>]* can match no characters

0 Karma

p_basanth
New Member

Figured out the issue. The field before empty has 2 angular braces <>. Now working fine. Thanks for the pointer.

0 Karma

p_basanth
New Member

No luck !! Tried '*' in the place of '+'. Not able to locate 3rd last field

0 Karma

p_basanth
New Member

Original sample Event:

 ####      <> <> <> <1363678659879>  <54% of the total memory in the server is free>

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...