Splunk Search

rex extraction for field value with space

nikkkc
Path Finder

hi,
would someone be so kind and help me to build a rex expression? i want to extract all "Audit ID" from this sample Log:

May 31 17:36:05 xxx.xxx.xxx.xxx May 31 17:37:04 mail33 ecelerity[23851]: ML-REJECT: Rejection on: xxx.x.xx.x:25, sent to host: 111.1111.111.111:56482, Audit ID ac13e885-1234567-32-574dafa09655, 554 5.7.1 You are not allowed to connect.#015

i want the hole text after the "Audit ID" string until the next comma.
Thanks in advanced

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This works on regex101.com with your sample event.

... | rex "Audit ID (?<auditID>[^,]*)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This works on regex101.com with your sample event.

... | rex "Audit ID (?<auditID>[^,]*)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

nikkkc
Path Finder

Thank you, this is exactly what i had, but now i realized the real problem: I forgot to mention that there are a lot of Events without the Audit ID and then it doesnt work. In approx. 200 Events the Audit ID is present just a few times. If i pre-filter the Events then the rex works !!
i do not understand this behaivor...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If an event does not contain the Audit ID field then rex will fail to find it. Any part of your query which relies on the Audit ID field will also fail.

The presence of the Audit ID field in a event is controlled by the application, not by Splunk.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

nikkkc
Path Finder

i believe you missanderstood, it´s right if an event does not contain the Audit Id field rex will fail to find it, this is a normal behavior. But if i have 100 Events in summary and 10 of them contains the Audit ID i would like to have the new field auditID with 80 NULL values and 10 correct matches.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Ah. Then you would want the fillnull command.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

nikkkc
Path Finder

...and i have to search for "Audit ID" because the ID is not always on the same place! i tried a lot but nothing works

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!