Splunk Search

Extract a substring and filter the results based on the extracted substring from incoming logs

nagar57
Communicator

I am pretty new to Splunk and finding a way to figure out below:
My incoming logs have a field message which contains String formatted value. e.g.

message="OVERALL_RESPONSE_TIME=43ms"
message="Correlation_id=123123hewgadkksksk"

Now I want to filter out messages which don't contain OVERALL_RESPONSE_TIME as a String and also extract OVERALL_RESPONSE_TIME as a field. I am looking for a single Eval expression to do so.

TIA

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not sure one can do that with a single eval. Try this query. The regex command filters out events that don't contain OVERALL_RESPONSE_TIME and the rex command extracts OVERALL_RESPONSE_TIME as a field.

... | regex message!="OVERALL_RESPONSE_TIME=\d+ms" | rex field=message "OVERALL_RESPONSE_TIME=(?<responseTime>\d+)" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...