Splunk Enterprise

need help on regex

vishwa
Path Finder

sample log:

{"date" : "2021-01-01 00:00:00.123 | dharam=fttc-pb-12312-esse-4 | appLevel=INRO | appName=REME_CASHE_ATTEMPT_PPI | env=sit | hostName=apphost000adc | pointer=ICFD | applidName=http.ab.web.com|news= | list=OUT_GOING | team=norpass | Category=success | status=NEW | timeframe=20", "tags": {"host": "apphost000adc" ,  "example": "6788376378jhjgjhdh2h3jhj2", "region": null, "resource": "add-njdf-tydfth-asd-1"}}

used below regex to extract all fields  , but  one field is not getting extracted, that is timeframe
|regex  _raw= (\w+)\=(.+?) \|

how to modify my regex to extract timeframe field as well.

Labels (1)
0 Karma

SierraX
Communicator

Hi,
regex _raw is here the wrong command…
regex - Splunk Documentation
but rex seems wrong too

rex - Splunk Documentation

because it can't do a key value extraction in search.
I found an odd way tho handle this:

| spath | rename _raw AS temp date AS _raw | extract pairdelim="|" kvdelim="=" | rename _raw as date temp as _raw


reference: extract - Splunk Documentation
Is this what you are searching for?
Bildschirmfoto 2024-04-09 um 20.14.19.png

Kind Regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The timeframe field is not terminated by a pipe, like the other fields, so the regex doesn't match.  Try this:

| rex "(\w+)=([^\|\"]+)"
---
If this reply helps you, Karma would be appreciated.

vishwa
Path Finder

thanks it worked

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...