Greetings, The event that I'm working with is below. The problem is that our platform (in this case) has a field called 'parm', which Splunk extracts. However, I need to extract the field as 'mobileNetworkCode' with the associated values. Sadly, my efforts to accomplish this using rex have not been successful. The part that I'm having trouble with is properly extracting the field values (260 in this example). Any assistance is certainly appreciated.
MobileApi.1.tue:1018 23:01:31.87: [MobileApiThread1] >> tan_lookup3_q handle=33 contextid=aab81b0d1fb8969 sessionid=0 classid=14072 ani=NNNNNNNNNNN method=8 type=1 lock_time=60 map_time=60 svc_id=5718352036 controlNumber=4435209740 dn=+NNNNNNNNNNN rawdn=+NNNNNNNNNNN aniBlocked= otg=AND-TANSPA_X sctype=1 cac= isCustServ=false locked=false callAni=NNNNNNNNNN country=US callsetupid=0a1823013187aac **parm=mobileNetworkCode=260** mobileCountryCode=310 mobileCarrierName=XXXXXXXX
↧