Splunk Search

need help in extracting a substring from a string

owie6466
Explorer

hello splunkers! new to splunk and i am needing to extract a word from a message field.

this is the message

The Cluster Service service entered the running state.

i want to extract "running state" and use it to indicate a status of a server.

thank you!

Labels (1)
Tags (1)
0 Karma
1 Solution

codebuilder
Influencer

Pipe your existing search to erex, give the field a name and provide an example.

...| erex ServiceState examples="running state"

When your search completes use the job inspector to find the regex that Splunk used to find your match.

https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
Influencer

Pipe your existing search to erex, give the field a name and provide an example.

...| erex ServiceState examples="running state"

When your search completes use the job inspector to find the regex that Splunk used to find your match.

https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

owie6466
Explorer

thanks! 🙂

0 Karma

owie6466
Explorer

this worked great!!!!!!

0 Karma

codebuilder
Influencer

Glad it worked for you! erex is a hidden gem 🙂

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...