topic Re: Is it possible to create an event type field within a source type? in Getting Data In

Is it possible to create an event type field within a source type?

jorell — Fri, 19 Aug 2016 19:24:20 GMT

Hi,

I was wondering if it was possible to create a field within the source type that would show the event type.

Here is a record from my log:

2016-06-05T19:55:10,144  INFO LoadProperties:225 - LoadProperty - Initial fetch for properties is successful

I would like to have INFO (and other types, like ERROR, WARN etc) as their own field within the source type. How can I do this? I'm new to Splunk and am currently using Splunk Enterprise 6.4.

Re: Is it possible to create an event type field within a source type?

Raghav2384 — Fri, 19 Aug 2016 19:50:36 GMT

Hello @jorell, could you please more info? What i understand is you are looking to create a filed that will hold the INFO,ERROR and WARN values? Is that what you are looking for?

You can extract fields always using regular expressions and eval: https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Extractfieldswithsearchcommands.

Just to give you an idea, i extracted the Value INFO and assigned it to the Key = Level(Log Level)

|gentimes start=-1|eval Event="2016-06-05T19:55:10,144 INFO LoadProperties:225 - LoadProperty - Initial fetch for properties is successfu"|rex field=Event "\s(?P\w+)\s"

Please provide more info with an example if this is not even close to what you're looking for.

Hope this helps!

Thanks,
Raghav

Re: Is it possible to create an event type field within a source type?

sundareshr — Fri, 19 Aug 2016 19:51:36 GMT

Use the field extractions page to extract fields by sourcetype. Here's docs on that. http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Managesearch-timefieldextractions

Once in IFX, chose to write your own regular expression and enter this. Make sure you set the right permissions, after creating the field.

,\d+\s*(?<type>\w+)

*OR*

(?<type>INFO|WARN|DEBUG|ERROR)

Re: Is it possible to create an event type field within a source type?

jorell — Fri, 19 Aug 2016 20:02:43 GMT

Each Log has a type of warning it is after the timestamp, as you've seen. I just want to be able to search for anything that is of the ERROR type, or of the WARN time. So, anyway I can do that will be fine. There is a comma, a number than the log type, which in my example is INFO.

Re: Is it possible to create an event type field within a source type?

jorell — Fri, 19 Aug 2016 20:02:59 GMT

Thanks for the speedy reply, btw

Re: Is it possible to create an event type field within a source type?

Raghav2384 — Fri, 19 Aug 2016 20:48:04 GMT

np 🙂 Please provide sample events with all possible patterns and we will help you with the dream extraction 🙂

Thanks,
Raghav