I am still trying to get my head around regular expressions in splunk, and would like to use regex that could parse the _raw data to create an extracted field with the contents that are between the square brackets:
_raw example data looks like this:
2023-07-26 15:11:16.932 [ engine1] [Error-1] INFO java.Exception: example text
2023-07-26 15:11:16.932 [ core2] [Thread-5] WARN java.Exception: example text 2
2023-07-26 15:11:16.932 [ main3] [Token-2] INFO java.Exception: example text 3
2023-07-26 15:11:16.932 [ Job4] [Thread-1] WARN java.Exception: example text 4
I need to extract field that is based on the data between the first square brackets.
If I need another field that is based on teh second square brackets.
So, I would like the results to look like like below:
Field_1 Field_2
engine1 Error-1
core2 Thread-5
main3 Token-2
Job4 Thread-1
Any feedback and help would greatly appreciated.
Thanks
Something like this should work.
<your search>
| rex field=_raw " \[(?<Field_1>.+?)\] \[(?<Field_2>.+?)\] "
You might have to adjust some of the spaces and other characters to match your events. The brief description of the regex above is:
Documentation for rex has some good examples.
Hope that helps!
Something like this should work.
<your search>
| rex field=_raw " \[(?<Field_1>.+?)\] \[(?<Field_2>.+?)\] "
You might have to adjust some of the spaces and other characters to match your events. The brief description of the regex above is:
Documentation for rex has some good examples.
Hope that helps!
Thank you for the reply, the solutions provided worked great, exactly what I needed.
Much appreciated.
"\[(?<field_1>[^\]]+)\]\[(?<field_2>[^\]]+)\]"