Splunk Search

ESA field extraction using regex!

kiran331
Builder

Hi

How to extract the field for the below sample ESA logs.

Sun Jun 11 17:33:36 2017 Info: Double bounce: MID 112011 to 0 - 5.1.2 - Bad destination host 'DNS Hard Error looking up abc.com (MX): KKDOMAIN'

Sun Jun 11 10:30:23 2017 Info: Double bounce: MID 221212 to 0 - 5.4.7 - Delivery expired (message too old) [Default] 451-'Open is not allowed please check'

I need the

field1="Bad destination host" & "Delivery expired (message too old) "

field2="'DNS Hard Error looking up abc.com (MX): KKDOMAIN" & "Open is not allowed please check"

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi kiran331,

based on the provided examples and based on my assumption that field1 always has the MID 112011 and field2 has the MID 221212 you can use this regex:

 MID\s\d+\sto\s\d\s-\s5\.1\.2\s-\s(?<field1>[^\r\n]+)|MID\s\d+\sto\s\d\s-\s5\.4\.7\s-\s(?<field2>[^\r\n]+)

Hope this helps ...

cheers, MuS

Updated after comment ...

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi kiran331,

based on the provided examples and based on my assumption that field1 always has the MID 112011 and field2 has the MID 221212 you can use this regex:

 MID\s\d+\sto\s\d\s-\s5\.1\.2\s-\s(?<field1>[^\r\n]+)|MID\s\d+\sto\s\d\s-\s5\.4\.7\s-\s(?<field2>[^\r\n]+)

Hope this helps ...

cheers, MuS

Updated after comment ...

0 Karma

kiran331
Builder

MID will be different for each events, is there a way to get the field values after 5.1.2 - OR 5.4.7-

0 Karma

MuS
SplunkTrust
SplunkTrust

sure, see my updated answer 😉

0 Karma

kiran331
Builder

HI Mus, Thanks for the solution. Is there a way to update this for all values not only 5.1.2 Or 5.4.7, it has different values.

0 Karma

MuS
SplunkTrust
SplunkTrust

If you want to have them all in the same field name, Yes. Otherwise you would have to use different field names and therefore different regex's for each 5.1.2 or 5.4.7 like number. So for example for matches into one field name you can use this:

 MID\s\d+\sto\s\d+\s-\s\d\.\d\.\d\s-\s(?<field>[^\r\n]+)
0 Karma

MuS
SplunkTrust
SplunkTrust

or you use props.conf and transforms.conf like this:

props.conf

[mySourceType]
REPORT-myDynamicFieldName = myDynamicFieldName

transforms.conf

[myDynamicFieldName]
REGEX  = MID\s\d+\sto\s\d+\s-\s(\d\.\d\.\d)\s-\s([^\r\n]+)
FORMAT = fieldname_$1::$2

This will create a dynamic field name like fieldname_5.1.2 or fieldname_5.4.7 in search time ...
Maybe this helps?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...