Splunk Search

How to parse specific value from a field value?

wicke_s
Explorer

Disclaimer : I'm new to Regex and using the Rex function

I have a field "Message" that has the following string format:

"EWT_Print=282, CIQ=1, Did not meet the threshold, 009s5td"

All the Message field values are going to have the same format "EWT_Print=[some number], CIQ=[some number], some text"

I am trying to extract the value of the EWT_Print, in this example 282 and display it in a table, however, I always get an empty table when I try this:

<my base search> | rex field=Message "EWT_Print=(?<EWT>[0-9]+)*"

What am I doing wrong?

0 Karma
1 Solution

jnudell_2
Builder

Try:

... [ your search ] ... 
| rex "EWT_Print=(?<EWT>[^,]+),"

If that works, then try:

... [ your search ] ... 
| rex field=Message "EWT_Print=(?<EWT>[^,]+),"

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

@wicke_s - Try this regex. (make sure field Message is not containing "(quote) in value.)

^EWT_Print=(?<EWT_Printer>\d+),
0 Karma

pranay_adla
Explorer
  <base search> | rex field=Message "EWT_Print\=(?P<EWT>\d+)\,"
0 Karma

vnravikumar
Champion

Hi

Try this,

| makeresults 
| eval Message = "EWT_Print=282, CIQ=1, Did not meet the threshold, 009s5td" 
| rex field=Message "EWT_Print\=(?P<EWT>[\d]+)"
0 Karma

jnudell_2
Builder

Try:

... [ your search ] ... 
| rex "EWT_Print=(?<EWT>[^,]+),"

If that works, then try:

... [ your search ] ... 
| rex field=Message "EWT_Print=(?<EWT>[^,]+),"

wicke_s
Explorer

This did the trick, The ',' is what I was missing.....

<search> | rex "EWT_Print=(?<EWT>[0-9]+)," 

is the query that worked for me. Thanks a lot

0 Karma

jkat54
SplunkTrust
SplunkTrust

Are you searching in verbose mode? Because verbose mode auto extracts key value pairs like these you have.

If not in verbose mode you can use the '| extract' command to achieve the same result.

0 Karma

wicke_s
Explorer

Thanks for your reply! I am searching in verbose mode and I also tried the search with the "extract" keyword. Still returns empty table

0 Karma

jkat54
SplunkTrust
SplunkTrust

What's your full search?

0 Karma

wicke_s
Explorer
index=<index> sourcetype=<sourcetype> Message="EWT_Print*" | rex field=Extended_Field.Message "EWT_Print=(?<EWT>[0-9]+)"| table EWT
0 Karma

jkat54
SplunkTrust
SplunkTrust

Try renaming the field first
...
| rename Extended_Field.Message as message
| rex field=message
...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your regex looks good, although the * is not needed. It works in regex101.com. Have you tried without the *?

---
If this reply helps you, Karma would be appreciated.
0 Karma

wicke_s
Explorer

Yes, I got the regex from regex101.com 🙂

I tried without the * and it still doesn't work. I tried without the table and I could see I have at least 133 events matching the search, however the rex still doesn't work.

Thanks for taking the time to look into this!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...