Splunk Search

How to extract a string from a field that contains letters, numbers and characters?

jfeitosa_real
Path Finder

731/5000
How to extract a field that can contain letters, numbers and characters, as in the example below?
The field to extract is the policyName that always comes preceded by the instanceId field.

Ex:

policyName = Unrestricted Inbound Access on network security groups instanceId = 5313
policyName = Unrestricted MongoDB Access in network security groups instanceId = 5313
policyName = [Exchange] - CPF totalMatchCount = 12 instanceId = 5319
policyName = Unencrypted OS disks instanceId = 5313
policyName = Check Disable Telnet (port 23) access on Network Security Groups from Internet instanceId = 5313

I have tried several ways, but it is only extracting the first word after the "=" sign, eg. "[Exchange]", "Unrestricted", etc ...

Can anyone help?

Thank you very much in advance.

0 Karma
1 Solution

Sukisen1981
Champion
| makeresults |eval x="Ex: policyName = Unrestricted Inbound Access on network security groups instanceId = 5313
policyName = Unrestricted MongoDB Access in network security groups instanceId = 5313
policyName = [Exchange] - CPF totalMatchCount = 12 instanceId = 5319
policyName = Unencrypted OS disks instanceId = 5313
policyName = Check Disable Telnet (port 23) access on Network Security Groups from Internet instanceId = 5313" | rex field=x "policyName+\s+\=(?<pname>.*?)instanceId" max_match=0

View solution in original post

0 Karma

jfeitosa_real
Path Finder

To extract the field in inline mode.

I used this REGEX:

(?:policyName = (?P<policy>.*)instanceId)

Thank you very much.

0 Karma

Sukisen1981
Champion
| makeresults |eval x="Ex: policyName = Unrestricted Inbound Access on network security groups instanceId = 5313
policyName = Unrestricted MongoDB Access in network security groups instanceId = 5313
policyName = [Exchange] - CPF totalMatchCount = 12 instanceId = 5319
policyName = Unencrypted OS disks instanceId = 5313
policyName = Check Disable Telnet (port 23) access on Network Security Groups from Internet instanceId = 5313" | rex field=x "policyName+\s+\=(?<pname>.*?)instanceId" max_match=0
0 Karma

jfeitosa_real
Path Finder

Hi Sukisen!

It worked in search time. But inline extract does not. What would it look like for extract inline?

Thank you.

James

0 Karma

Sukisen1981
Champion

hi @jfeitosa_real
It should work in inline search as well.
Is the inline search a table in a dashboard? If yes, check the time range of the search
it could be that your logs are multispaced in that case use this regex - rex field=x "(?ms)policyName+\s+\=(?<pname>.*?)instanceId" max_match=0

0 Karma

jfeitosa_real
Path Finder

Hi @Sukisen1981 .

In fact it is to extract the field without research.

I got it this way:

(?:policyName=(?P<policy>.*)instanceId)

Thanks for your attention, your example helped me find this result.

Thank you very much.

James []s

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...