Splunk Search

Query regarding splunk field extraction

p_basanth
New Member

Using the below regex I was able to extract first7 fields
Need to extract the last 3 fields
How to skip the blank <> <> tags and continue?

Sample Event:

####(DateTime) (Info) (Health) (host.domain.name) (component1) (component2) ((anonymous)) () () (1363678659879) (BEA-310002) (54% of the total memory in the server is free)

The original event has angular braces <> as the field delimiter above. Due to browser compatibility i have changed them to normal braces()

Regex working fine (first 7 fields):
####<(?P< F1>[^>]+)> \s+<(?P[^>]+)>\s+<(?P[^>]+)>\s+<(?P[^.]+)[^<\n]<(?P[^>]+)>\s+<(?P[^>]+)>\s+<(?P[^>]+>)>


Below regex not working (after 7th field):
####<(?P< FIELDNAME1>[^>]+)> \s+<(?P[^>]+)>\s+<(?P[^>]+)>\s+<(?P[^.]+)[^<\n]<(?P[^>]+)>\s+<(?P[^>]+)>\s+<(?P[^>]+>)>[^>\n]>\s[^>\n]>\s+<(?P[^>]+)>\s+<(?P[^>]+)>\s+<(?P[^>]+)>

Tags (2)
0 Karma

datasearchninja
Communicator

You need to change the '+' to a '*' in any field that can be empty.

e.g:
[^>]+ must match at least one character that is not '>'
[^>]* can match no characters

0 Karma

p_basanth
New Member

Figured out the issue. The field before empty has 2 angular braces <>. Now working fine. Thanks for the pointer.

0 Karma

p_basanth
New Member

No luck !! Tried '*' in the place of '+'. Not able to locate 3rd last field

0 Karma

p_basanth
New Member

Original sample Event:

 ####      <> <> <> <1363678659879>  <54% of the total memory in the server is free>

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...