All Apps and Add-ons

Extracting field below variable

aaronkorn
Splunk Employee
Splunk Employee

Hello, we are looking at errpt messages and are having difficulty extracting certain fields from the text below:

Everything with a ":" was easy to extract the value but we are having problems extracting the field below Description, which would be REPAIR ACTION in the first example. Any idea how to extract this file or a regex that would accomplish this?

Date/Time: Mon Jan 14 10:23:35 EST 2013
Sequence Number: 4287
Machine Id: 00F6BEB14C00
Node Id: h1dev16
Class: H
Type: INFO
WPAR: Global
Resource Name: fscsi2

Resource Class:

Resource Type:

Location:

Description
REPAIR ACTION
User Causes
PARTS REPLACEMENT

Date/Time: Wed Jan 9 17:49:04 EST 2013
Sequence Number: 4283
Machine Id: 00F6BEB14C00
Node Id: h1dev16
Class: O
Type: INFO
WPAR: Global
Resource Name: hdisk57

Description
PATH HAS RECOVERED
Probable Causes
ADAPTER HARDWARE OR CABLE
DASD DEVICE
Failure Causes
EF00

0 Karma

jkat54
SplunkTrust
SplunkTrust

Assuming thats a line break:

rex field="yourfield" "(?<desc>(?<=Description\r)(.*))" | table desc

http://gskinner.com/RegExr/ is a great tool for these scenarios

aaronkorn
Splunk Employee
Splunk Employee

This does not seem to work for us. If we were to copy that regex into the field extraction tool it cant seem to match (?(?<=Description\r)(.*))

0 Karma

jkat54
SplunkTrust
SplunkTrust

Since you didnt mention you would put this in the field extractor I told you how to do it with the rex command.,

To do it in field extractor, you could change it to (?<=Description\r)(.*)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...