Splunk Search

How to extract these fields from my sample data?

vrmandadi
Builder

Hello Experts,

Below is the sample event

event_type:  LogMessage 
    ip:  xx.x.xx.xx 
    job:  router_z1 
    job_index:  1 
    level:  info 
    message_type:  OUT 
    msg:  url.com - [04/01/2017:19:37:03.701 +0000] "GET /api/v1/vha/supported-vehicles HTTP/1.1" 200 0 1565 "-" "fordpass-app-na/17 CFNetwork/808.2.16 Darwin/16.3.0" xx.x.xx.xx:45810 x_forwarded_for:"xxx.xx.xxx.xx, xx.xx.xx.xxx, xx.x.xx.xx" x_forwarded_proto:"https" vcap_request_id:8d612e09-f611-415f-6172-a688700be726 response_time:0.004987 app_id:19065d0e-f6da-4cc3-8a71-581fd768dafe

origin:  gorouter 
source_instance:  1 
source_type:  RTR 
time:  2017-01-04T19:37:03Z 
timestamp:  1483558623706728200

I am trying to extract the "GET /api/v1/vha/supported-vehicles " and other similar kinds like "POST /oauth/token", "GET /eureka/apps/delta" ,GET /api/v1/badges,"GET /api/v1","POST /api/v1/humanify-session" etc in the message field.

I tried using the erex command

erex clean examples="GET /api/v1/badges,GET /api/v1,POST /api/v1/record" 

but it is not showing all of them and I also tried using IFX, but I can only select one field...

Is there any other way to extract all these fields from the msg app other than regex...

Thanks for the help

0 Karma

gokadroid
Motivator

If GET and POST is all you are interested in then you can try this as well:

your base search
| rex "\"(?<actionUri>(GET|POST)\s*?[\S]+)"
| table actionUri

If additional actions are needed feel free to add in (GET|POST|...) part of the above rex

vrmandadi
Builder

Thank You!

0 Karma

somesoni2
Revered Legend

Is this a json data?

Try something like for now

your base search | rex "\]\s+\"(?<message>\w+\s+\S+)"

vrmandadi
Builder

Hi somesh, so using rex command is the only way to extract them?....is there a way to use IFX or erex

0 Karma

somesoni2
Revered Legend

If your logs and the string that you're trying to extract is not formatted in a standard way (they don't follow same patter/position for all events), the erex and IFX may fail to extract all values. Using your custom regular expression which will explicitly take care of all variation is the way to go in cases like that.

0 Karma

vrmandadi
Builder

ok thank you somesh

0 Karma

somesoni2
Revered Legend

You'll be able to save the regular expression that you used in search as field extraction, so that its automatically available (similar to what IFX would have done).

0 Karma