Splunk Search

rex extraction for field value with space

nikkkc
Path Finder

hi,
would someone be so kind and help me to build a rex expression? i want to extract all "Audit ID" from this sample Log:

May 31 17:36:05 xxx.xxx.xxx.xxx May 31 17:37:04 mail33 ecelerity[23851]: ML-REJECT: Rejection on: xxx.x.xx.x:25, sent to host: 111.1111.111.111:56482, Audit ID ac13e885-1234567-32-574dafa09655, 554 5.7.1 You are not allowed to connect.#015

i want the hole text after the "Audit ID" string until the next comma.
Thanks in advanced

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This works on regex101.com with your sample event.

... | rex "Audit ID (?<auditID>[^,]*)" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This works on regex101.com with your sample event.

... | rex "Audit ID (?<auditID>[^,]*)" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

nikkkc
Path Finder

Thank you, this is exactly what i had, but now i realized the real problem: I forgot to mention that there are a lot of Events without the Audit ID and then it doesnt work. In approx. 200 Events the Audit ID is present just a few times. If i pre-filter the Events then the rex works !!
i do not understand this behaivor...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If an event does not contain the Audit ID field then rex will fail to find it. Any part of your query which relies on the Audit ID field will also fail.

The presence of the Audit ID field in a event is controlled by the application, not by Splunk.

---
If this reply helps you, Karma would be appreciated.
0 Karma

nikkkc
Path Finder

i believe you missanderstood, it´s right if an event does not contain the Audit Id field rex will fail to find it, this is a normal behavior. But if i have 100 Events in summary and 10 of them contains the Audit ID i would like to have the new field auditID with 80 NULL values and 10 correct matches.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Ah. Then you would want the fillnull command.

---
If this reply helps you, Karma would be appreciated.
0 Karma

nikkkc
Path Finder

...and i have to search for "Audit ID" because the ID is not always on the same place! i tried a lot but nothing works

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...