Splunk Search

Stuck on extracting fields using own RegEx

StuReeves
Explorer

Hi, still finding my around Spplunk and I've sort of go what I want in pt2 of my requirements, but after a couple of days, I'm just going around in a spin.

I'm trying to split up the raw data from an Avaya CM. I've go it coming in, managed to break each entry into a single line but then I get stumped trying to break it up further using the Extract Fields. I presume I need to ad this to either props or transforms, but at a loss what I need to enter.

The Avaya data comes in a fixed format such as:

and so on.

Using rex101 I created the expression

^(.{6})\s(.{4})\s(.{5})\s(.{1})\s(.{4})\s(.{4})\s(.{18})\s(.{15})\s(.{4})\s(.{7})\s(.{3})\s(.{3})\s(.{11})\s(.{5})\s(.{15})\s(.{2})\s(.{6})

which seems to work pefectly in the test.

However I'm at a complete loss as where to go next so that each field is split up and named. I've always used the Field Extraction tool, but it's the 1st time I've tried using my own, as opposed to standard delimiters.
All that I get is a tick next to my values, but can't do anything from there.
Sure it's something pretty simple, but I'm just stumped.
Thanks once again
Stu..

0 Karma
1 Solution

niketn
Legend

@StuReevs... Since you have not attached mock data in the question... I would expect the following to work. You seem to be missing names for extracted fields, Please test yourself in regex101 first. You can also test the same in Splunk using rex SPL command. Please change the field names from field1 thru field17 to something meaningful based on what you need.

^(?<field1>.{6})\s(?<field2>.{4})\s(?<field3>.{5})\s(?<field4>.{1})\s(?<field5>.{4})\s(?<field6>.{4})\s(?<field7>.{18})\s(?<field8>.{15})\s(?<field9>.{4})\s(?<field10>.{7})\s(?<field11>.{3})\s(?<field12>.{3})\s(?<field13>.{11})\s(?<field14>.{5})\s(?<field15>.{15})\s(?<field16>.{2})\s(?<field17>.{6})
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@StuReevs... Since you have not attached mock data in the question... I would expect the following to work. You seem to be missing names for extracted fields, Please test yourself in regex101 first. You can also test the same in Splunk using rex SPL command. Please change the field names from field1 thru field17 to something meaningful based on what you need.

^(?<field1>.{6})\s(?<field2>.{4})\s(?<field3>.{5})\s(?<field4>.{1})\s(?<field5>.{4})\s(?<field6>.{4})\s(?<field7>.{18})\s(?<field8>.{15})\s(?<field9>.{4})\s(?<field10>.{7})\s(?<field11>.{3})\s(?<field12>.{3})\s(?<field13>.{11})\s(?<field14>.{5})\s(?<field15>.{15})\s(?<field16>.{2})\s(?<field17>.{6})
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

StuReeves
Explorer

Thats done the trick. I knew it was something fairly simple I was missing.

0 Karma

niketn
Legend

@StuReeves... Happens to all of us... all the time! Glad it worked 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...