Splunk Search

Field Extraction problem

bfernandez
Communicator

I am trying to extract some data from a script output.
Sample:
SERVICE_NAME: WebTrends - Data Retention Service
DISPLAY_NAME: WebTrends - Data Retention Service
TYPE : 10 WIN32_OWN_PROCESS

STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
I have checked successfully the Generated pattern (regex) with the Interactive Field Extractor and also using a query.
index=main sourcetype="services_monitoring_status" | head 10000 | rex "(?i)SERVICE_NAME: (?P.+)"
But curiously if I save this regex as a Field extraction doesn’t work…because not only take the name. It takes all the rest of the event, not break at the end of the line.
Expected behavior:
Namefield = WebTrends - Data Retention Service
Incorrect behavior:
Namefield= WebTrends - Data Retention Service DISPLAY_NAME: WebTrends - Data Retention Service TYPE : 10 WIN32_OWN_PROCESS STATE : 1 STOPPED WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0
So How is possible this differents behavior doing the same?

Tags (3)
0 Karma

hjwang
Contributor

try this

rex "(?i)SERVICE_NAME:\s+(?P<fieldname>.+)([\r\n\s]+)"
0 Karma

bfernandez
Communicator

This regex in a query works as well

index=main sourcetype="services_monitoring_status" | head 10000 | rex "(?i)SERVICE_NAME:\s+(?P.+)([\r\n\s]+)"

But If I save it as a field extraction in the console, it returns the same wrong values…as mine

(?i)SERVICE_NAME:\s+(?P.+)([\r\n\s]+)

Is strange that could returns different results depending on how you apply the regex.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...