Splunk Search

Field extraction

Deepz2612
Explorer

Hi ,

For logs such as below please help me in extracting the data enclosed within double quotes.

Contact Dealership Name="Amery",Role= "IT_Deal"
Contact Dealership Name="US",Role= "IT_Deal"
Contact Dealership Name="J. Nuckolls, Inc. dba Fenton Auto Sales",Role= "IT_DEAN"

I tried using rex field=_raw "Contact Dealership Name=\"(?[^,]+)\""
But the results are as below :

Dealership_Name 
Amery
US

but J. Nuckolls, Inc. dba Fenton Auto Sales is not included in the result.
how the rex_field has to be modified to capture that also

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Hey @Deepz2612

Try this, you will be able to extract dealership name and role in one regex

| rex field=_raw “Contact\sDealership\sName=(\"|\s)(?P<ContactDealershipName>[^\"]+)\",Role=(\s|)\"(?P<Role>[^\"]+)”

Let me know if this works!

View solution in original post

0 Karma

mayurr98
Super Champion

Hey @Deepz2612

Try this, you will be able to extract dealership name and role in one regex

| rex field=_raw “Contact\sDealership\sName=(\"|\s)(?P<ContactDealershipName>[^\"]+)\",Role=(\s|)\"(?P<Role>[^\"]+)”

Let me know if this works!

0 Karma

niketn
Legend

@mayurr98, max_match=0 needs to be added in case this is a single event. Contact Dealership Name does not have space after equal to sign and before double quotes. However Role has a space before double quotes. So, the following regex should also work.

You have special character double quotes in the code above for regular expression convert to simple double quotes "

@Deepz2612, following is the run anywhere search based on your sample data:

| makeresults
| eval _raw="Contact Dealership Name=\"Amery\",Role= \"IT_Deal\"
 Contact Dealership Name=\"US\",Role= \"IT_Deal\"
 Contact Dealership Name=\"J. Nuckolls, Inc. dba Fenton Auto Sales\",Role= \"IT_DEAN\"
"
| rex "Contact\sDealership\sName=\"(?<contact_dealership_name>[^\"]+)\",Role=\s\"(?<role>[^\"]+)\"" max_match=0
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Deepz2612
Explorer

Great!
Thanks @niketnilay. this worked and thank you so much for helping me out.

0 Karma

ifotopoulos
Explorer

Try the following regex:

Contact Dealership Name=\"(.+?)\"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...