Splunk Search

Rex fields from a log fle

rczone
Path Finder

I have the log snippet below want to extract id and hostname into 2 different fields

for example in the expected output from below is

id               host
rmk123     abc.bbb.com@hostname.com
rmc143     bdc.ab.cpm@hostname.com

[01/05/2020 13:06:21] BAUAJM_I_30031 Client [CA WAAE Auto:15515][5][abc@hostname.com:50019:12.304.593.10] [0x80c91100][02/05/2020 13:06:21.8474][0:rmk123@abc.bbb.com@hostname.com 0] API ID [34] execution started.

[01/05/2020 13:06:21] BAUAJM_I_30032 Client [CA WAAE Auto:15509][5][bdc.ab.cpm@hostname.com:12345:19.304.293.10] [0x28bbbfff][02/05/2020 13:06:21.6946][0:rmc143@bdc.ab.cpm@hostname.com 0] API ID [66] execution completed. Total time: 0.132519 seconds.

Please assist

0 Karma

vnravikumar
Champion

Hi @rczone

Try this

| makeresults 
| eval temp="[01/05/2020 13:06:21] BAUAJM_I_30031 Client [CA WAAE Auto:15515][5][abc@hostname.com:50019:12.304.593.10] [0x80c91100][02/05/2020 13:06:21.8474][0:rmk123@abc.bbb.com@hostname.com 0] API ID [34] execution started.,,

[01/05/2020 13:06:21] BAUAJM_I_30032 Client [CA WAAE Auto:15509][5][bdc.ab.cpm@hostname.com:12345:19.304.293.10] [0x28bbbfff][02/05/2020 13:06:21.6946][0:rmc143@bdc.ab.cpm@hostname.com 0] API ID [66] execution completed. Total time: 0.132519 seconds." 
| makemv delim=",," temp 
| mvexpand temp 
| rex field=temp "\[\S:(?P<id>[^\@]+)@(?P<host>[^\]]\S+)" 
| table id, host

manjunathmeti
Champion

You can use below regex:

| rex field=<FIELD_NAME> "\[0:(?<id>[a-z0-9]+)@(?<name>[a-z@.]+) 0\]" 

Test query:

| makeresults | eval test="[01/05/2020 13:06:21] BAUAJM_I_30031 Client [CA WAAE Auto:15515][5][abc@hostname.com:50019:12.304.593.10] [0x80c91100][02/05/2020 13:06:21.8474][0:rmk123@abc.bbb.com@hostname.com 0] API ID [34] execution started.&[01/05/2020 13:06:21] BAUAJM_I_30032 Client [CA WAAE Auto:15509][5][bdc.ab.cpm@hostname.com:12345:19.304.293.10] [0x28bbbfff][02/05/2020 13:06:21.6946][0:rmc143@bdc.ab.cpm@hostname.com 0] API ID [66] execution completed. Total time: 0.132519 seconds." | makemv delim="&" test  | mvexpand test | rex field=test "\[0:(?<id>[a-z0-9]+)@(?<name>[a-z@.]+) 0\]" | table id, name, test

somesoni2
Revered Legend

Assuming those values always located in the same relative position( 7th value from starting which are enclosed between square brackets), give this a try

your base search 
| rex "^\[([^\[]+\[){6}[^:]+:(?<id>[^\@]+)@(?<host>\S+)"

Regex101 example of the regex: https://regex101.com/r/1gPnL8/1

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...