Splunk Search

Rex Field

jwursteisen
Engager

...

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Definitely.

Try this instead of the rex

| rename _raw as raw
| rename logMessage as _raw
| extract kvdelim=":" pairdelim="~"
| rename _raw as logMessage
| rename raw as _raw

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please check (and correct if necessary) the formatting of the second example, for instance, in the first example, the colon (:) sometimes has a space after and sometimes before as well. Since spaces are used in your pattern matching, it is important to get this as accurate as possible.

0 Karma

jwursteisen
Engager

Thank you, I looked into the formatting of the spaces. In the second event, there is no space between backendIdentifier and GFEDCBA-UUU, ceoCompanyId and EDCBA222, SOURCE_SYSTEM and SOURC1. There is a space between 'ERP_CLIENT:' and 'true'

logMessage: backendIdentifier:GFEDCBA-UUU ~ ceoCompanyId:EDCBA222 ~ SOURCE_SYSTEM:SOURC1 ~ ERP_CLIENT: true

 In the first example, there a space before and after these words:

logMessage: ceoCompanyId : ABCDE111 ~ SOURCE_SYSTEM : SOURC1 ~ ERP_CLIENT: true

Do you think this may have an effect on the missing result?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Definitely.

Try this instead of the rex

| rename _raw as raw
| rename logMessage as _raw
| extract kvdelim=":" pairdelim="~"
| rename _raw as logMessage
| rename raw as _raw
0 Karma

jwursteisen
Engager

Excellent. That worked prefect!  Thank you very much! 

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...