Splunk Search

field extraction from source log path

ravir_jbp
Explorer

 

how to extract the node name from the different GC source location:

I have below sample three source location and I am looking for rex that can extract node name as "node02, Node03 and "web39". My rex command is not working.

source= E:\total\int\ts1\Ddoss\node\node02\data\gc.log
source=E:\total\int\ts1\Ddoss\swxx\node03\data\gc.log
source=E:\total\int\ts1\Ddoss\web\web39\data\gc.log

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I would be cautious to anchor regex as closely as the data is regular.  Something like

 

| rex field=source "\\\t4\\\(apch\\\node|logs)\\\(?<node>[^-\\\\]+)"

 

This should give

nodesource
node06E:\view\int\t4\apch\node\node06\log\server.log
node06E:\view\int\t4\apch\node\node06\log\run.log
node03E:\view\int\t4\apch\node\node03\log\server.log
node01E:\view\int\t4\apch\node\node01\log\server.log
node01E:\view\int\t4\apch\node\node01\log\run.log
core02E:\view\int\t4\logs\core02-core.log
web37E:\view\int\t4\logs\web37-wfmws.log
core01E:\view\int\t4\logs\core01-core.log

You can play with the emulation @ITWhisperer offered and compare with real data.

 

| makeresults format=csv data="source
E:\view\int\t4\apch\node\node06\log\server.log
E:\view\int\t4\apch\node\node06\log\run.log
E:\view\int\t4\apch\node\node03\log\server.log
E:\view\int\t4\apch\node\node01\log\server.log
E:\view\int\t4\apch\node\node01\log\run.log
E:\view\int\t4\logs\core02-core.log
E:\view\int\t4\logs\web37-wfmws.log
E:\view\int\t4\logs\core01-core.log"
``` data emulation above ```

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=source "^([^\\\\]+\\\\){6}(?<node>[^\\\\]+)"
0 Karma

ravir_jbp
Explorer

@ITWhisperer 

I tried using above rex for these log source but not working:

For below 5 different log source I like to extract node number like node06, node03, node01

E:\view\int\t4\apch\node\node06\log\server.log
E:\view\int\t4\apch\node\node06\log\run.log
E:\view\int\t4\apch\node\node03\log\server.log
E:\view\int\t4\apch\node\node01\log\server.log
E:\view\int\t4\apch\node\node01\log\run.log

For below 3 log source I like to extract as core02, web37, core01


E:\view\int\t4\logs\core02-core.log
E:\view\int\t4\logs\web37-wfmws.log
E:\view\int\t4\logs\core01-core.log

 

Since both log format is different above solution you shared is not working. Please help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Here is a runanywhere example showing it working

| makeresults format=csv data="source
E:\view\int\t4\apch\node\node06\log\server.log
E:\view\int\t4\apch\node\node06\log\run.log
E:\view\int\t4\apch\node\node03\log\server.log
E:\view\int\t4\apch\node\node01\log\server.log
E:\view\int\t4\apch\node\node01\log\run.log
E:\view\int\t4\logs\core02-core.log
E:\view\int\t4\logs\web37-wfmws.log
E:\view\int\t4\logs\core01-core.log"
| rex field=source "^([^\\\\]+\\\\){5}(?<node>[^-]+)"
| rex field=source "^([^\\\\]+\\\\){6}(?<node>[^\\\\]+)"

Note if these different formats for source are used in the same search then the order is significant, otherwise just use the relevant rex pertaining to the source name format

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...