Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About arpitpropay
arpitpropay
Explorer
Member since:
05-07-2019
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 05-07-2019 |
Activity Feed
- Got Karma for Re: Field extraction using rex command - dynamic regex with lookup. 06-17-2025 09:36 AM
- Karma Re: Why is my extracted field not showing up in search result for vishaltaneja070. 06-05-2020 12:50 AM
- Posted Re: Field extraction using rex command - dynamic regex with lookup on Splunk Search. 03-09-2020 03:51 PM
- Posted Re: Field extraction using rex command - dynamic regex with lookup on Splunk Search. 03-09-2020 03:09 PM
- Posted Re: Field extraction using rex command - dynamic regex with lookup on Splunk Search. 03-09-2020 10:41 AM
- Posted Field extraction using rex command - dynamic regex with lookup on Splunk Search. 03-09-2020 09:03 AM
- Tagged Field extraction using rex command - dynamic regex with lookup on Splunk Search. 03-09-2020 09:03 AM
- Tagged Field extraction using rex command - dynamic regex with lookup on Splunk Search. 03-09-2020 09:03 AM
- Tagged Field extraction using rex command - dynamic regex with lookup on Splunk Search. 03-09-2020 09:03 AM
- Tagged Field extraction using rex command - dynamic regex with lookup on Splunk Search. 03-09-2020 09:03 AM
- Posted Field extraction using dynamic regular expression - rex command on Splunk Search. 03-09-2020 08:58 AM
- Tagged Field extraction using dynamic regular expression - rex command on Splunk Search. 03-09-2020 08:58 AM
- Tagged Field extraction using dynamic regular expression - rex command on Splunk Search. 03-09-2020 08:58 AM
- Tagged Field extraction using dynamic regular expression - rex command on Splunk Search. 03-09-2020 08:58 AM
- Tagged Field extraction using dynamic regular expression - rex command on Splunk Search. 03-09-2020 08:58 AM
- Tagged Field extraction using dynamic regular expression - rex command on Splunk Search. 03-09-2020 08:58 AM
- Posted Re: Why is my extracted field not showing up in search result on Splunk Search. 05-08-2019 08:30 AM
- Posted Why is my extracted field not showing up in search result on Splunk Search. 05-07-2019 02:07 PM
- Tagged Why is my extracted field not showing up in search result on Splunk Search. 05-07-2019 02:07 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
03-09-2020
03:51 PM
1 Karma
I finally came to a workable solution using map
| inputlookup my_fields_xml.csv
| stats list(FieldName) as FieldName delim="|"
| nomv FieldName
| eval KeyRegex = "\"(?<FieldName>(" + FieldName + "))\":(?!\s*{\[)\"*(?<Value>(?!\[+{|{+|null)[^(,|}|\")]*)"
| fields KeyRegex
| map search="search index=index1
| rex field=_raw max_match=0 $KeyRegex$....."
... View more
03-09-2020
03:09 PM
I am working with events having nested JSON. Splunk extracts top level JSON but there's an array with nested objects. It does not have consistent structure inside it and inside it Splunk does not extract the fields very well (it does but they appear like Parameters{}.Customer.CustomerId. Not all events have some structure of customerId. So I am trying to extract it using regex)
{
"TimeStamp": "2020-03-09 12:01:39.451",
"Type": "Info",
"Message": "Some message",
"Host": "SERVER01", ,
"Parameters": [{
"Customer": {
"CusmerId": "888000000587",
"Name": "[email protected]",
}
}, false]
}
... View more
03-09-2020
10:41 AM
The reason I am trying to parse JSON using regex is that I have nested JSON objects with dynamic structure. I would like to be able to find all key value pairs in the events regardless of their depth in the raw JSON. Splunk is parsing those objects but as I said they have dynamic structure and do not have a consistent object hierarchy
For example
Parent{}.Customer.RelationshipId
Parent{}.RelationshipId
Parent{}.Order.Customer.RelationshipId and so on.
... View more
03-09-2020
09:03 AM
I am trying to extract key value pairs from JSON events using rex command
mysearch | rex field=_raw max_match=0 "\"(?<Key>\b\w+[^\":]*)\":(?!\s*{\[)\"*(?<Value>(?!\[{|{|\[)[^(,|}|\")]*)"
I have a single column CSV lookup with all the key names I am interested in
| inputlookup my_fields_json.csv | fields FieldName
Is there a way to use the lookup to make my rex command regular expression dynamic so I only extract the fields I am interested in?
... View more
03-09-2020
08:58 AM
I am trying to extract key value pairs from JSON events using rex command
mysearch | rex field=_raw max_match=0 "\"(?<Key>\b\w+[^\":]*)\":(?!\s*{\[)\"*(?<Value>(?!\[{|{|\[)[^(,|}|\")]*)"
I have a single column CSV lookup with all the key names I am interested in
| inputlookup my_fields_json.csv | fields FieldName
Is there a way to use the lookup to make my rex command regular expression dynamic so I only extract the fields I am interested in?
... View more
05-08-2019
08:30 AM
Thanks @vishaltaneja07011993 your solution (using field transformation in field extraction) worked for me.
... View more
05-07-2019
02:07 PM
I have several log files as source of Splunk events.
C:\logs\Srv1\file1_2019-05-06.log
C:\logs\Srv84\file3_2019-05-06.log
C:\logs\Glob9\file18_2019-05-06.log
I am trying to extract the immediate parent directory name from the source field of events. So in a custom extracted field "appname", I am hoping to get values Srv1, Srv84 and Glob9 from examples above.
Here's what I am doing.
Splunk Web > Settings > Fields > Fields Extractions > Add new
Destination app: search
Name: source_app_name
Apply to: source named: app_name
Type: Inline
Extraction/Transform: ^.+\x5C(?<appname>(.+))\x5C[^\x5C]*$
Sharing: Global, All apps, Read permission to everyone.
When I run my search ...| extract reload=t I can't find appname field in All fields. All fields is selected in the Select field list.
Am I doing anything wrong with my field extraction, or with my search?
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
