Splunk Search

How to fetch the values from log using regular expression?

aqaadi
Engager

Hi Team,

Need your help on below search:

I'm spitting something like this in the log:

My Test Data|My Test ID|My Case Status|My verification code|My Comments on case

The log has the data similar to above format delimited by pipe "|"

I have around 8 fields in this way and I want to extract them in a table format and send the output to a service.

Can you help me achieve it?

0 Karma

aqaadi
Engager

I tried the regex expression regex _raw=(ML\D{17})|(\D{3}\d{6}-\d{6}) and it worked. However i see entire log snippet is being returned instead of just the data present in regex expression.

Any idea how to achieve this?

0 Karma

vnravikumar
Champion

Hi

Try like

| makeresults 
| eval test="aaa|bbb|ccc|ddd|eee" 
| eval result=split(test,"|") 
| eval My_Test_Data=mvindex(result,0),My_Test_ID=mvindex(result,1),My_Case_Status=mvindex(result,2),My_verification_code=mvindex(result,3),My_Comments_on_case=mvindex(result,4) 
| table My_Test_Data My_Test_ID My_Case_Status My_verification_code My_Comments_on_case

aqaadi
Engager

This worked thanks

0 Karma

aqaadi
Engager

what should be the value of makeresults here ?

0 Karma

aqaadi
Engager

thanks let me try it.
How do i passs the log snippet at runtime to test variable?

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...