Splunk Search
Highlighted

rex extraction for field value with space

Path Finder

hi,
would someone be so kind and help me to build a rex expression? i want to extract all "Audit ID" from this sample Log:

May 31 17:36:05 xxx.xxx.xxx.xxx May 31 17:37:04 mail33 ecelerity[23851]: ML-REJECT: Rejection on: xxx.x.xx.x:25, sent to host: 111.1111.111.111:56482, Audit ID ac13e885-1234567-32-574dafa09655, 554 5.7.1 You are not allowed to connect.#015

i want the hole text after the "Audit ID" string until the next comma.
Thanks in advanced

Tags (2)
0 Karma
Highlighted

Re: rex extraction for field value with space

Path Finder

...and i have to search for "Audit ID" because the ID is not always on the same place! i tried a lot but nothing works

0 Karma
Highlighted

Re: rex extraction for field value with space

SplunkTrust
SplunkTrust

This works on regex101.com with your sample event.

... | rex "Audit ID (?<auditID>[^,]*)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: rex extraction for field value with space

Path Finder

Thank you, this is exactly what i had, but now i realized the real problem: I forgot to mention that there are a lot of Events without the Audit ID and then it doesnt work. In approx. 200 Events the Audit ID is present just a few times. If i pre-filter the Events then the rex works !!
i do not understand this behaivor...

0 Karma
Highlighted

Re: rex extraction for field value with space

SplunkTrust
SplunkTrust

If an event does not contain the Audit ID field then rex will fail to find it. Any part of your query which relies on the Audit ID field will also fail.

The presence of the Audit ID field in a event is controlled by the application, not by Splunk.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: rex extraction for field value with space

Path Finder

i believe you missanderstood, it´s right if an event does not contain the Audit Id field rex will fail to find it, this is a normal behavior. But if i have 100 Events in summary and 10 of them contains the Audit ID i would like to have the new field auditID with 80 NULL values and 10 correct matches.

0 Karma
Highlighted

Re: rex extraction for field value with space

SplunkTrust
SplunkTrust

Ah. Then you would want the fillnull command.

---
If this reply helps you, an upvote would be appreciated.
0 Karma