Splunk Search

Splunk Rex query to extract field after a particular exact word only

jonthree
Explorer

So this is my sample data :

10.3.31.252 - - 15/Mar/2021:14:06:28 +0000 "POST /usenames/rest/sessionscookie dest oamdashboard-oamdashboard.myapp.com/usenames/rest/sessionscookie location usenames upstream_host 10.3.58.247:80 response_from_above 401 user- - - - - myuser myuser 1

 

I want to extract the status code from this string (which is 401) and user value which is myuser (BOLD sentence mentioned in above logs)

How should i write a rex for this in splunk search query ? Also it may happen that status code does not contain any value and instead of 401, value will be simply hyphen(-).

Also, hyphens after user field may vary and i want exactly 5 hyphens to match the word, otherwise not.

I tried to achieve this by using following:

| rex "response_from_above (?<status>\d+) user - - - - - (?<userid>\w+)" but i am not able to figure this out.

Labels (2)
0 Karma
1 Solution

Vardhan
Contributor

Hi @jonthree,

You can search the status logs using search command.

| rex "response_from_above\s+(?<status>\d+)\s+user.*\s+(?<user>\w+)\s+\w+\s+\d" |search status=401

This search will only return status 401 logs.

If this answer helps you then up vote it.

View solution in original post

Vardhan
Contributor

Hi,

use the below regex.

| rex "response_from_above\s+(?<status>\d+)\s+user.*\s+(?<user>\w+)\s+\w+\s+\d"

jonthree
Explorer

Thanks. Also, how do i search for a particular status on this ..like if i want to search the logs having 401 status code only and not with status code 200 or 500 ?

Tags (1)
0 Karma

Vardhan
Contributor

Hi @jonthree,

You can search the status logs using search command.

| rex "response_from_above\s+(?<status>\d+)\s+user.*\s+(?<user>\w+)\s+\w+\s+\d" |search status=401

This search will only return status 401 logs.

If this answer helps you then up vote it.

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...