Splunk multiple field extraction

[ppatkar]

 I have the below Splunk Event & need to extract multiple fields from the same :

[TIMESTAMP=2021-02-19 12:16:30.684 UTC] [RUN_ID=] [TRACE_ID=] [STEP=End Processing] [LINE_NO=701] [LOG_LEVEL=TRACE] [MESSAGE=[ppv] [insert] Query completed , total 11 ms: [10 values] INSERT INTO errors (job,run,timestamp,count,alert,error,code,message,completets,active) VALUES (?,?,?,?,?,?,?,?,?,?); [job:'endcustomer--prod', run:'4569876', timestamp:1613736990530, count:200, alert:'failed after launch', error:'', code:'E302: Batch failed', message:'', completets:'', active:false]]

Expected Table Output :

job	run	code
endcustomer--prod	4569876	E302: Batch failed

I was able to pick some field like :

run\:\'(?<run>\w+)'

https://regex101.com/r/q7NqQb/1

However, unable to extract all the three fields above. Any help is appreciated.

[jotne]

All in on rex

Your search
| rex "job:'(?<job>[^']+)'. run:'(?<run>[^']+)'.*? code:'(?<code>[^']+)'"
| table job run code

[manjunathmeti · Accepted solution]

hi @ppatkar,

Use rex command twice:

| rex "job:'(?<job>[^']+)',\srun:'(?<run>[^']+)"
| rex "code:'(?<code>[^']+)'"
| table job, run, code

If this reply helps you, an upvote/like would be appreciated.

[ppatkar]

Hi @manjunathmeti 

I have one followup to the earlier , in certain events I see truncated output like below :

[TIMESTAMP=2021-02-19 12:16:30.684 UTC] [RUN_ID=] [TRACE_ID=] [STEP=End Processing] [LINE_NO=701] [LOG_LEVEL=TRACE] [MESSAGE=[ppv] [insert] Query completed , total 11 ms: [10 values] INSERT INTO errors (job,run,timestamp,count,alert,error,code,message,completets,active) VALUES (?,?,?,?,?,?,?,?,?,?); [job:'endcustomer--pr..[truncated output], run:4569876, timestamp:1613736990530, count:200, alert:'failed after launch', error:'', code:'E302: Batch failed', message:'', completets:'', active:false]]

This is causing my job to get derived as null . Can you please advise ?

[manjunathmeti]

Try this:

| rex "job:'?(?<job>[^']+)'?,\srun:'?(?<run>\d+)'?"
| rex "code:'(?<code>[^']+)'"
| table job, run, code

 If this reply helps you, an upvote/like would be appreciated.