Splunk Search

how to extract one value from log

ivana27
Path Finder

Hi,

i have log like this

[Information] WebService Call CheckVehicle : country=111111, licensePlate=12DUMMY

And i would like to extract only licensePlate using maybe rex.

Thank you

Labels (1)
0 Karma
1 Solution

Kwip
Contributor

Hi @ivana27 ,  @gcusello  is right.

So you mean the log format is going to be the same and  country value will change ? And you want to extract licensePlate values on this pattern of logs?

Try something below, 

| rex field=_raw "country=\d+\, licensePlate=(?<LicensePlateNumber>[^ ]+)"

View solution in original post

Kwip
Contributor

Hi @ivana27 ,

If you want to extract only from the mentioned log, include the unique information from the specific log

 

| rex field=_raw "country=111111\, licensePlate=(?<LicensePlate>[^ ]+)"

0 Karma

ivana27
Path Finder

Hi @Kwip ,

thank you for helping. Problem is this just example i gave, values for country and licensePlate are different in events. So, i need from that row to take only value of license.

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ivana27,

if you cannot identify a more complex regex (as me an @Kwip hinted), the only way if my other hint: use a different name for the regex extracted field.

Ciao.

Giuseppe

0 Karma

Kwip
Contributor

Hi @ivana27 ,  @gcusello  is right.

So you mean the log format is going to be the same and  country value will change ? And you want to extract licensePlate values on this pattern of logs?

Try something below, 

| rex field=_raw "country=\d+\, licensePlate=(?<LicensePlateNumber>[^ ]+)"

gcusello
SplunkTrust
SplunkTrust

Hi @ivana27,

you should already have the required field extraction because Splunk recognises the pair field_name=field_value.

Anyway, using regex, you could try something like this:

| rex "licensePlate\=(?<licensePlate>[^ ]+)"

that you can test at https://regex101.com/r/oQDejO/1

Ciao.

Giuseppe

ivana27
Path Finder

Thank you for quick respond, i already put same rex command but in event there is several places where licensePlate is shown but i want extract only from that exact log mentioned here.

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ivana27,

if this answer solves your problem please accept it for the other people of Community, otherwise tell me if I can help you more.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

ivana27
Path Finder

Hi,

thank you for reply. I still didnt solve it 😞

Is it possible to refer only to this log and extract only from there licence?

Thank you

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ivana27,

if the problem is that the Regex takes more values that the correct one, the only way is to create a regex more complex that recognizes only the correct values.

If the problem is that the licensePlate field is also automatically extracted by Splunk and sometimes in a not correct way, you could use a different name for the regex extraction and use that field instead the other in your searches.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...