Skip to content

Splunk Practice Exercise 14: Extract Fields Using rex II

Introduction

This practice exercise focuses on extracting the 'other' field from the _raw field using the rex command in Splunk.

Step 1: Access Splunk Web

  1. Open your web browser and navigate to Splunk Web:

    http://<your server ip>:8000

  2. Log in using your credentials.

Step 2: Run the Query

  1. In the Splunk Web interface, go to the Search & Reporting app.

  2. Run the following query to extract the 'other' field using _raw and rex:

    index=tutorial other=* | rex field=_raw "(?<OtherField>\d{3})\s*$"

    This query uses the rex command to capture the regex content within double quotes and names the captured content as OtherField. In this case, the other fields is the last 3 string characters of the events, so we'll take advantage of that to extract the field.

  3. Verify the new field creation under OtherField like below.

    otherfield1

    The values should be identical to that of the original other field.

    otherfield2

Step 3: Verify results in table form

  1. In this step we can refer to the newly created field to be piped onto the query. In the search bar, enter the following search query:

    index=tutorial other=* | rex field=_raw "(?<OtherField>\d{3})\s*$" | stats count by other, OtherField

  2. Output should have 2 columns with identical values like so:

    othertable

Conclusion

Congratulations! You have successfully completed the practice exercise, extracting the 'other' field from the _raw field using the rex command in Splunk. This skill is valuable for extracting specific information from the raw event data. Continue to explore and experiment with different extraction scenarios to enhance your Splunk skills.