topic Re: Extract Data with Field Definition in All Apps and Add-ons

Extract Data with Field Definition

ciscotek9 — Mon, 04 Nov 2013 20:31:28 GMT

How would you extract particular info from raw data that is not defined by a field and then add it to a new field?

The name of databases being sent to logs all end in *db but can appear randomly in the raw data.

We want to pull them from raw data put them in column by themselves named "Database" with the corresponding raw data line that it appears in.

95% of the databases named end in "*db". A few are one offs but when we can find the solution for the ones that end in *db hopefully the answer will come.

Re: Extract Data with Field Definition

lukejadamec — Mon, 04 Nov 2013 20:39:06 GMT

Can you post some examples of the logs, and point out what you mean by 'raw data line'?

Re: Extract Data with Field Definition

kristian_kolb — Mon, 04 Nov 2013 20:44:55 GMT

Well, one thing to try is to use rex to extract the name as a field. If this works fine, you can then make it permanent by making the changes in props.conf (or via IFX).

Consider these sample events;

"The quick brown fox-db jumps over the lazy dog"
"All work and no play makes Jack a dull boydb"
"Crane-db, the most powerful tool at the building site"

To extract the database-strings from these type of events, you might try;

...| rex "(?<my_db>\S+db)" | table my_db

and the output would be;

my_db
-----
fox-db
boydb
Crane-db

Please provide a few sample events if you want more qualified advice.