Splunk Dev

extract field data using regex for space delimited logs

adwaitkaley
Engager

Hi, my splunk logs are in the following format :

"POST /v2/endpoint HTTP/1.0" 200 91 "http://example.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" 0.029 "127.0.0.1" "some-id"

I need to extract the status (200 in this case) and the response time (0.029 in this case) in my splunk search ?

How can I achieve this, I tried using regex's but the same delimiting fails as the data also has spaces 😞

Any way I can get these ?

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi adwaitkaley,
try with

\"[^\"]*\"\s(?<status>\d+)([^\"]*\"){4}\s(?<response_time>[^ ]*)

or in command

| rex "\"[^\"]*\"\s(?<status>\d+)([^\"]*\"){4}\s(?<response_time>[^ ]*)"

could you share some additional samples, probably there's some additional problem (see https://regex101.com/r/yYhGra/1)

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi adwaitkaley,
try with

\"[^\"]*\"\s(?<status>\d+)([^\"]*\"){4}\s(?<response_time>[^ ]*)

or in command

| rex "\"[^\"]*\"\s(?<status>\d+)([^\"]*\"){4}\s(?<response_time>[^ ]*)"

could you share some additional samples, probably there's some additional problem (see https://regex101.com/r/yYhGra/1)

Bye.
Giuseppe

adwaitkaley
Engager

Hi cusello,

Awesome ! This is exactly what I was looking for 🙂
I literally hate the way the logs are setup, key-value pairs make life a hell lot easier.
Is there a way we can tokenize the other elements in the logs too ?
That would help immensely.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi adwaitkaley,
in the same way

\"(?<field1>[^\"]*)"\s(?<status>\d+)\s(?<substatus>\d+)\s\"(?<url>[^\"]*)\"\s\"(?<client>[^\"]*)\"\s(?<response_time>[^ ]*)\s\"(?<IP>[^\"]*)\"\s\"(?<field2>[^\"]*)\"

see https://regex101.com/r/yYhGra/2

If this answer satisfies your need, please accept it.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...