Field Extraction with transforms configuration

SplunkDash — Tue, 19 Dec 2023 02:44:19 GMT

Hello,

I have issues getting expected field value pairs using following props and transforms configuration files. Sample events and my configuration files are given below. Any recommendation will be highly appreciated.

My Configuration Files

[mypropsfile]

REPORT-mytranforms=myTransfile

[myTransfile]
REGEX = ([^"]+?):\s+([^"]+?)
FORMAT = $1::$2

Sample Events

2023-11-15T18:56:30.098Z, User ID: 90A, User Type: TempEMP, Product Code: pc, UAT: UTA-True, Event Type: TEST, EventID: Lookup, Remote Host: 25.191.157.244

2023-11-15T18:56:29.098Z, User ID: 90A, Host: vx2tbax.dev, User Type: TempEMP, Product Code: pc, UAT: UTA-True, Event Type: TEST, EventID: Lookup, Remote Host: 25.191.157.244

2023-11-15T18:56:28.098Z, User ID: 91B, User Type: TempEMP, Product Code: pc, UAT: UTA-True, Event Type: TEST, EventID: Lookup, Remote Host: 25.191.157.244

2023-11-15T18:56:27.098Z, User ID: 91B, User Type: TempEMP, Product Code: pc, UAT: UTA-True, Event Type: TEST, EventID: Lookup, Remote Host: 25.191.157.244

2023-11-15T18:56:27.001Z, User ID: 91B, User Type: TempEMP, Host: vx2tbax.dev, Product Code: pc, UAT: UTA-True, Event Type: TEST, EventID: Lookup, Remote Host: 25.191.157.244

Re: Field Extraction with transforms configuration

dtburrows3 — Tue, 19 Dec 2023 02:55:24 GMT

First glance it looks like this the regex you provided is looking for double quote to help find the pattern and the sample event don't seem to have any.

I think you may have better luck using a regex closer to

REGEX = \s+([^:]+?):\s+([^,]+)

I havent tested locally but on regex 101 it looks like it matches pretty well

Re: Field Extraction with transforms configuration

SplunkDash — Tue, 19 Dec 2023 03:03:59 GMT

Hello @dtburrows3,

Thank you so much for your quick response, truly appreciate it. I am getting this:

topic Field Extraction with transforms configuration in Security

Field Extraction with transforms configuration

Re: Field Extraction with transforms configuration

Re: Field Extraction with transforms configuration