Splunk Search

Filtering out part of a value?

NizanCohen
Explorer

Hi all.

I'm working with a FTP server which include a session number with each status and I wish to exclude the session number to be separate value to use later.

Example of the fields are:

[12345156]quit

[14365361]pass

I tried using replace "[*]" with * in cs_status but it won't remove the session number (inside the [] is the session number).

Basic search query:

"index=application sourcetype=FTPlogs"

 

 

Thank you for the assistance!

Labels (1)
0 Karma

NizanCohen
Explorer

I managed to resolve it by using "extract new fields" and simply selected an example of each desired field and Splunk made the regex and the fields for me.

 

Thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @NizanCohen,

good for you, bu anyway I hint to learn to build your regexes by yourself because they are very much useful!

Please accept one answer for the other people of Community

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @NizanCohen,

let me understand, are you speaking to replace "[9999]action" with "999action"?

do you mean at search time or at index time?

If at search time, you could use the rex command.

Ciao.

Giuseppe

0 Karma

NizanCohen
Explorer

I prefer making the session a separate field.

If possible without the []

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @NizanCohen,

yes you can do it, you need a regex, could you share a sample of your logs?

it should be something like this:

| rex field=your_field "^\[(?<session>\d+)\]"

Ciao.

Giuseppe

0 Karma

NizanCohen
Explorer

Hi.

Here's an example of two fields:

[1153909]type
[1168228]created

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...