field extraction

[splunklearner]

Hi, 

Please extract DUSTER and JUNIPER as app_name from following sample events - 

1. unit_hostname="GBWDC111AD011HMA.systems.uk.fed"

support_id="16675049156208762610"

vs_name="/f5-tenant-01/DUSTER-GBM-FR-DEV/v-dusteruat.systems.uk.fed-443"

policy_name="/Common/waf-fed-transparent" 

2. unit_hostname="GBWDC111AD011HMA.systems.uk.fed"

support_id="16675049156208762610"

vs_name="/f5-tenant-01/JUNIPER-GBM-FR-DEV/v-juniperuat.systems.uk.fed-443"

policy_name="/Common/waf-fed-transparent" 

The app_names will be dynamic and there is no gurantee that everytime GBM will not be coming beside app_names.

I tried this - vs_name=\"\/.*\/(?<app_name>.*)\-GBM

but as I told everytime GBM will not same in all events. Please make it generic and give the regex for me. Thanks

[kiran_panchavat]

@splunklearner Please check this

| makeresults count=2 
| eval vs_name1="/f5-tenant-01/DUSTER-GBM-FR-DEV/v-dusteruat.systems.uk.fed-443"
| eval vs_name2="/f5-tenant-01/JUNIPER-GBM-FR-DEV/v-juniperuat.systems.uk.fed-443"
| eval vs_name=mvappend(vs_name1, vs_name2)
| mvexpand vs_name
| rex field=vs_name "\/[^\/]+\/(?<app_name>[^\/\-]+)"
| table vs_name, app_name

[ITWhisperer · Accepted solution]

Regular expressions work on pattern matching and two examples is not many to secure a reliable pattern, that being said, if your data has already been extracted into the vs_name field, you could try something like this

| rex field=vs_name "^\/[^\/]+\/(?<app_name>\w+)\-"