Splunk Search

How to create a regular expression for a field in a log file?

mderosa
New Member

Hi, first of all thanks for help me.

I have this log file:

2016-11-21T16:29:25.690+0100 INFO    2867 com.l7tech.log.custom.csm: -4: SplunkService=LIVEpolicy_csmws_poas
... 20 lines omitted ...
                  <![CDATA[
                     <CategoryAvailabilityRequest>
    <SessionInfo>
        <SessionID>value</SessionID>
        <Profile>A</Profile>
        <Language>DEU</Language>
        <Version>1</Version>
    </SessionInfo>
    <BookingContext>
        <AgencyID>value</AgencyID>
        <BookingContactName>XML Test</BookingContactName>
        <MarketCode>value</MarketCode>
        <BookingCurrencyCode>value</BookingCurrencyCode>
        <LanguageCode>value</LanguageCode>
        <OfficeCode>DEU</OfficeCode>
    </BookingContext>
    <CruiseComponent>
        <ComponentID>value</ComponentID>
        <PromotionCode>didu20198212</PromotionCode>

I need to create the field OfficeCode then take the value to create a dashboard.

Splunk in automatic way do not recognize this field, could you help me to create a regular expression?

Thanks
Massimiliano

0 Karma
1 Solution

gokadroid
Motivator

The one given by @sundareshr should work fine if office code has \w worth of data, however if there are more than \w type of data that can be part of officeCode then you can give this a try as well as \w only covers [a-zA-Z0-9_]:

... | rex "OfficeCode\>(?<OfficeCode>[^\<]+)\<" | table OfficeCode

View solution in original post

gokadroid
Motivator

The one given by @sundareshr should work fine if office code has \w worth of data, however if there are more than \w type of data that can be part of officeCode then you can give this a try as well as \w only covers [a-zA-Z0-9_]:

... | rex "OfficeCode\>(?<OfficeCode>[^\<]+)\<" | table OfficeCode

mderosa
New Member

Thank you both the expression works well!

0 Karma

sundareshr
Legend

Try this

... | rex "OfficeCode\>(?<office_code>\w+)\<" |...
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...