Splunk Search

Multiple-lines fields extraction from an already extracted field

royimad
Builder

Hello,

I have a text extracted in a field called MessageBody , the text contains multilines not a single lines and fields are separated by dash "-"
The text format is the following:
Field1 - Field2 - Needed Field3 -
Field4 - Field5
Another Field1 - Another Field2 - Another Needed Field3 -
Another Field4 - Another Field5

I need a regular expression to extract Fields number 3, How can i do that?

Tags (3)
0 Karma

kristian_kolb
Ultra Champion

The following should work as an extract in props.conf; non-space followed by space, dash, space - two times, then grab all non-space as field3

EXTRACT-blah = (?m)^(\S+\s\-\s){2}(?<field3>\S+)

0 Karma

nekb1958
Path Finder

Hi

sounds for me similar to my problem to parse the email of my dsl-router with embedded logline entries.
I stored the entries (unique pattern "timestamp followed from 4 spaces") as a multivalue field with a transformation and then splitted it in timestamp-logmessage pairs with

index=mail | mvexpand logevents | table logevents | rex field=logevents "..." | ...

in your case i would try to split the field MessageBody at the end of line characters into a mv-field with makemv

after that "mvexpand MessageBody" maybe with a trailing " | table MessageBody "

and then parse every line (now a single event) with a regex like

rex field=MessageBody "(?[^-]+)-(?[^-]+)-(?[^-]+)-"

maybe that helps you to find your solution?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...