Splunk Search

need help in extracting a substring from a string

owie6466
Explorer

hello splunkers! new to splunk and i am needing to extract a word from a message field.

this is the message

The Cluster Service service entered the running state.

i want to extract "running state" and use it to indicate a status of a server.

thank you!

Labels (1)
Tags (1)
0 Karma
1 Solution

codebuilder
SplunkTrust
SplunkTrust

Pipe your existing search to erex, give the field a name and provide an example.

...| erex ServiceState examples="running state"

When your search completes use the job inspector to find the regex that Splunk used to find your match.

https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Pipe your existing search to erex, give the field a name and provide an example.

...| erex ServiceState examples="running state"

When your search completes use the job inspector to find the regex that Splunk used to find your match.

https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

owie6466
Explorer

thanks! 🙂

0 Karma

owie6466
Explorer

this worked great!!!!!!

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Glad it worked for you! erex is a hidden gem 🙂

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...