Splunk Search

Multiple-lines fields extraction from an already extracted field

royimad
Builder

Hello,

I have a text extracted in a field called MessageBody , the text contains multilines not a single lines and fields are separated by dash "-"
The text format is the following:
Field1 - Field2 - Needed Field3 -
Field4 - Field5
Another Field1 - Another Field2 - Another Needed Field3 -
Another Field4 - Another Field5

I need a regular expression to extract Fields number 3, How can i do that?

Tags (3)
0 Karma

kristian_kolb
Ultra Champion

The following should work as an extract in props.conf; non-space followed by space, dash, space - two times, then grab all non-space as field3

EXTRACT-blah = (?m)^(\S+\s\-\s){2}(?<field3>\S+)

0 Karma

nekb1958
Path Finder

Hi

sounds for me similar to my problem to parse the email of my dsl-router with embedded logline entries.
I stored the entries (unique pattern "timestamp followed from 4 spaces") as a multivalue field with a transformation and then splitted it in timestamp-logmessage pairs with

index=mail | mvexpand logevents | table logevents | rex field=logevents "..." | ...

in your case i would try to split the field MessageBody at the end of line characters into a mv-field with makemv

after that "mvexpand MessageBody" maybe with a trailing " | table MessageBody "

and then parse every line (now a single event) with a regex like

rex field=MessageBody "(?[^-]+)-(?[^-]+)-(?[^-]+)-"

maybe that helps you to find your solution?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...