Splunk Search

Extracting multiple fields from a line

cutenemo
Engager

I have a line that contains 2 different fields that I need

Right now I have:
index=os sourcetype="xxx" | regex _raw="\d tests, \d assertions, \d failures, \d errors"

Which returns for example:
2 tests, 2 assertions, 0 failures, 0 errors

How can I extract the fields tests and failures? would it be possible?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

somesoni2
SplunkTrust
SplunkTrust

Can you post some sample logs? Based on that people will be able to help you with field extractions.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

regex filters results, use rex to extract fields in a search: http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/rex

martin_mueller
SplunkTrust
SplunkTrust

I'm guessing this:

... | rex "(?<tests>\d+) tests, (?<assertions>\d+) assertions, (?<failures>\d+) failures, (?<errors>\d+) errors"

However, without seeing your actual events that's only that, a guess.

0 Karma

cutenemo
Engager

the number actually comes before \d tests

0 Karma

cutenemo
Engager

can you post how we can do it with rex, I'm still struggling

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...