Splunk Search

REX - Extracting multiple fields- What's the rex syntax to return microService AND warningMessage?

Mick_OBrien
Path Finder

I have raw message of the form...

2022-08-15T10:41:54.266337+00:00 microService 9bc7520a-4f8d-4edc-a4cd-b08c0fae8992[[APP/PROC/WEB/2]] APPENDER=APP, DATE=2022-08-15 10:41:54.266, LEVEL=WARN , USER=, THREAD=[pool-25-thread-1], LOGGER=Factory, CORR=, INT_CORR=, X-VCAP-REQUEST-ID=, MESSAGE=warningMessage

What's the rex syntax to return microService AND warningMessage?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Field names are case sensitive so microService is not the same as microservice (the name of the field in the rex extract)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "^\S+\s(?<microservice>\S+).*MESSAGE=(?<message>.+)"

https://regex101.com/r/nE14zp/1

0 Karma

Mick_OBrien
Path Finder

Tried....

index=splunkIndex "*LEVEL=WARN*" | rex "^\S+\s(?<microservice>\S+).*MESSAGE=(?<message>.+)" | table _raw, microService, message

...and I see the message but NOT the microservice

FYI the returned _raw message starts...

2022-08-15T10:53:25.650962+00:00 microService

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Field names are case sensitive so microService is not the same as microservice (the name of the field in the rex extract)

Mick_OBrien
Path Finder

Thank  you - that worked!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...