topic Re: How do I create extractions where it can pick field names from the events See events below in Getting Data In

How do I create extractions where it can pick field names from the events See events below

puneetkharband1 — Fri, 28 May 2021 03:37:49 GMT

I have 2 types of logs from one source where I need to map fields vs values ...I dont want to create complex regex as they are from structured data so how do I create fields and values from events

May 27 07:51:49 TESTHOSTTEST TESTDEVTEST_11.2.0.125: User '' (root) : FAILED: Sign On, ID: 123220127, InstID: 7653, IPAddress: 111.222.213.238, FolderID: 0, Username: root, AgentBrand: TEST DEV SSH, AgentVersion: 11.2.0.0, DEVSize: 0, Error: 2976, Message: Failed to sign on: This IP address has been locked out.

May 27 07:51:34 TESTHOSTTEST TESTDEVTEST_11.2.0.125: User 'BLA BLA DI' (ei4o2f18pcsuo5tp) : Download File, ID: 123220102, InstID: 7653, IPAddress: 333.222.231.94, FileID: 770879833, FileName: 16680_Signup Detail_20210527 01-49-18-86.csv, FolderID: 472070079, FolderPath: /Home/test/TestWorks/Enhanced Affiliate Signup Reports, Username: TEST, AgentBrand: Chrome Browser, AgentVersion: 90.0.4430.212, DEVSize: 739698, Parm2: 0, Error: 0

Re: How do I create extractions where it can pick field names from the events See events below

aasabatini — Fri, 28 May 2021 06:00:56 GMT

Hi @puneetkharband1

expand your event and select event actions > extract fields

it's will open another page like this, please select delimiters and click next

here select the delimiters other and insert ":" and modify your name fields

Re: How do I create extractions where it can pick field names from the events See events below

puneetkharband1 — Fri, 28 May 2021 12:55:23 GMT

this doesnt work I tried delimiter option.

Re: How do I create extractions where it can pick field names from the events See events below

aasabatini — Fri, 28 May 2021 13:08:10 GMT

Hi @puneetkharband1

are your sure that logs are structured data?, like as you shared looks like not structured, anyway if are not structured you need to use mandatory the regular expression.

Re: How do I create extractions where it can pick field names from the events See events below

puneetkharband1 — Fri, 28 May 2021 14:31:05 GMT

if you see there is one pattern and these logs are generated from a tool(Xfer) and only 2 types of logs are there which I posted.