- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to extract the all the field using rex?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to extract success and fatal into one field and also extract two Fields after FATAL
2018-06-18 02:06:34,606|261529301994221|MA_SELECT|785M91236|602304234|001|WGS20||||EMAIL|SPALACIOS810@GMAIL.COM|LEVEL2|||SUCCESS||
2018-06-18 02:06:34,294|7961529301994286|MA_SELECT|AN72688470000|202465241|001|NASCO||||EMAIL|SANGELI@OUTDRS.NET|LEVEL2|||
FATAL|E000057P|Member not found
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Shortcut approach to extract into result field:
| rex "\|(?<result>SUCCESS|FATAL)\|"
This is a shortcut since it assumes there are no other part of the event that could match this SUCCESS or FATAL string.
A safer approach would be to create a regex that extracts the SUCCESS/FATAL value from the expected location in the message:
| rex "(?:[^\|]*\|){15}(?<result>SUCCESS|FATAL)"
https://regex101.com/r/FvClhk/1
An other option is to configure delimiter based field extraction.
props.conf:
REPORT-extractfields = extractfields
transforms.conf
[extractfields]
DELIMS = "|"
FIELDS = field1, field2, field3
Note: replace the field1 etc. with your own list of comma separated field names.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If it's just FATAL or SUCCESS, you could try:
(?<status>FATAL|SUCCESS)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Shortcut approach to extract into result field:
| rex "\|(?<result>SUCCESS|FATAL)\|"
This is a shortcut since it assumes there are no other part of the event that could match this SUCCESS or FATAL string.
A safer approach would be to create a regex that extracts the SUCCESS/FATAL value from the expected location in the message:
| rex "(?:[^\|]*\|){15}(?<result>SUCCESS|FATAL)"
https://regex101.com/r/FvClhk/1
An other option is to configure delimiter based field extraction.
props.conf:
REPORT-extractfields = extractfields
transforms.conf
[extractfields]
DELIMS = "|"
FIELDS = field1, field2, field3
Note: replace the field1 etc. with your own list of comma separated field names.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to extract two fields after FATAL
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@karthi2809, try this extended version to extract remaining fields:
|rex field=data "\|(?<result>SUCCESS|FATAL)\|(?<number>\w+)?\|(?<status>[a-zA-Z ]+)?"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you so much
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Anam
Hi @karthi2809
My name is Anam and I am the Community Content Specialist for Splunk Answers. Please go ahead and accept the answer that worked for you. If it is a comment, let me know and I can convert it to an answer and accept it.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can you put the sample events in 101010 sample code format as I am not able to understand it
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
101010|101010|101010|101010|101010|101010|101010||||101010|101010|101010|||FATAL|E000110|file not found
101010|101010|101010|101010|101010|101010|101010||||101010| 101010 |101010|||SUCCESS||
101010|101010|101010|101010|101010|101010|101010|||101010|101010| 101010 |101010|||FATAL|E10021|file not found
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
he meant using the 101010 button in the editor, to mark the sample as code, that prevents special characters from dissapearing etc.
But take a look at my answer below and see if that works.
Introducing the Splunk Community Dashboard Challenge!
Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...
Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...
