Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Rex fields from a log fle
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Rex fields from a log fle
I have the log snippet below want to extract id and hostname into 2 different fields
for example in the expected output from below is
id host
rmk123 [email protected]
rmc143 [email protected]
[01/05/2020 13:06:21] BAUAJM_I_30031 Client [CA WAAE Auto:15515][5][[email protected]:50019:12.304.593.10] [0x80c91100][02/05/2020 13:06:21.8474][0:rmk123@[email protected] 0] API ID [34] execution started.
[01/05/2020 13:06:21] BAUAJM_I_30032 Client [CA WAAE Auto:15509][5][[email protected]:12345:19.304.293.10] [0x28bbbfff][02/05/2020 13:06:21.6946][0:rmc143@[email protected] 0] API ID [66] execution completed. Total time: 0.132519 seconds.
Please assist
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @rczone
Try this
| makeresults
| eval temp="[01/05/2020 13:06:21] BAUAJM_I_30031 Client [CA WAAE Auto:15515][5][[email protected]:50019:12.304.593.10] [0x80c91100][02/05/2020 13:06:21.8474][0:[email protected]@hostname.com 0] API ID [34] execution started.,,
[01/05/2020 13:06:21] BAUAJM_I_30032 Client [CA WAAE Auto:15509][5][[email protected]:12345:19.304.293.10] [0x28bbbfff][02/05/2020 13:06:21.6946][0:[email protected]@hostname.com 0] API ID [66] execution completed. Total time: 0.132519 seconds."
| makemv delim=",," temp
| mvexpand temp
| rex field=temp "\[\S:(?P<id>[^\@]+)@(?P<host>[^\]]\S+)"
| table id, host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use below regex:
| rex field=<FIELD_NAME> "\[0:(?<id>[a-z0-9]+)@(?<name>[a-z@.]+) 0\]"
Test query:
| makeresults | eval test="[01/05/2020 13:06:21] BAUAJM_I_30031 Client [CA WAAE Auto:15515][5][[email protected]:50019:12.304.593.10] [0x80c91100][02/05/2020 13:06:21.8474][0:[email protected]@hostname.com 0] API ID [34] execution started.&[01/05/2020 13:06:21] BAUAJM_I_30032 Client [CA WAAE Auto:15509][5][[email protected]:12345:19.304.293.10] [0x28bbbfff][02/05/2020 13:06:21.6946][0:[email protected]@hostname.com 0] API ID [66] execution completed. Total time: 0.132519 seconds." | makemv delim="&" test | mvexpand test | rex field=test "\[0:(?<id>[a-z0-9]+)@(?<name>[a-z@.]+) 0\]" | table id, name, test
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming those values always located in the same relative position( 7th value from starting which are enclosed between square brackets), give this a try
your base search
| rex "^\[([^\[]+\[){6}[^:]+:(?<id>[^\@]+)@(?<host>\S+)"
Regex101 example of the regex: https://regex101.com/r/1gPnL8/1
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Make Your Machine Data AI-Ready in Splunk
Splunk Asynchronous Forwarding Explained
How to Monitor AI Agents with Splunk Agent Observability
