Splunk Search

Stuck on extracting fields using own RegEx

StuReeves
Explorer

Hi, still finding my around Spplunk and I've sort of go what I want in pt2 of my requirements, but after a couple of days, I'm just going around in a spin.

I'm trying to split up the raw data from an Avaya CM. I've go it coming in, managed to break each entry into a single line but then I get stumped trying to break it up further using the Extract Fields. I presume I need to ad this to either props or transforms, but at a loss what I need to enter.

The Avaya data comes in a fixed format such as:

and so on.

Using rex101 I created the expression

^(.{6})\s(.{4})\s(.{5})\s(.{1})\s(.{4})\s(.{4})\s(.{18})\s(.{15})\s(.{4})\s(.{7})\s(.{3})\s(.{3})\s(.{11})\s(.{5})\s(.{15})\s(.{2})\s(.{6})

which seems to work pefectly in the test.

However I'm at a complete loss as where to go next so that each field is split up and named. I've always used the Field Extraction tool, but it's the 1st time I've tried using my own, as opposed to standard delimiters.
All that I get is a tick next to my values, but can't do anything from there.
Sure it's something pretty simple, but I'm just stumped.
Thanks once again
Stu..

0 Karma
1 Solution

niketn
Legend

@StuReevs... Since you have not attached mock data in the question... I would expect the following to work. You seem to be missing names for extracted fields, Please test yourself in regex101 first. You can also test the same in Splunk using rex SPL command. Please change the field names from field1 thru field17 to something meaningful based on what you need.

^(?<field1>.{6})\s(?<field2>.{4})\s(?<field3>.{5})\s(?<field4>.{1})\s(?<field5>.{4})\s(?<field6>.{4})\s(?<field7>.{18})\s(?<field8>.{15})\s(?<field9>.{4})\s(?<field10>.{7})\s(?<field11>.{3})\s(?<field12>.{3})\s(?<field13>.{11})\s(?<field14>.{5})\s(?<field15>.{15})\s(?<field16>.{2})\s(?<field17>.{6})
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@StuReevs... Since you have not attached mock data in the question... I would expect the following to work. You seem to be missing names for extracted fields, Please test yourself in regex101 first. You can also test the same in Splunk using rex SPL command. Please change the field names from field1 thru field17 to something meaningful based on what you need.

^(?<field1>.{6})\s(?<field2>.{4})\s(?<field3>.{5})\s(?<field4>.{1})\s(?<field5>.{4})\s(?<field6>.{4})\s(?<field7>.{18})\s(?<field8>.{15})\s(?<field9>.{4})\s(?<field10>.{7})\s(?<field11>.{3})\s(?<field12>.{3})\s(?<field13>.{11})\s(?<field14>.{5})\s(?<field15>.{15})\s(?<field16>.{2})\s(?<field17>.{6})
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

StuReeves
Explorer

Thats done the trick. I knew it was something fairly simple I was missing.

0 Karma

niketn
Legend

@StuReeves... Happens to all of us... all the time! Glad it worked 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...