Can't Extract Multiple Custom Fields

mxsullivan — Mon, 01 Aug 2011 21:32:05 GMT

Hello,

I'm trying to extract each of the 16 values following the "Latency:" string into 16 separate fields and then export the fields to a CSV file. The default extraction doesn't seem to extract them, so I used IFX to generate a Latency field, but that contained all 16 values in a single string, again, not what I need.

Jul 25 09:53:33 datapower xi50-opsSyslog [latency][info] mpgw(opsSftpExmFrontGateway): trans(942496)[10.1.131.205]: Latency: 0 1 0 0 0 0 0 1 1 1 13 13 0 1 0 1 [sftp://[::]:2060/dropbox;type=d]

Jul 25 09:55:30 datapower xi50-opsSyslog [latency][info] mpgw(opsSftpExmFrontGateway): trans(942512)[10.1.131.205]: Latency: 0 16 0 68259 68259 0 0 68260 68260 68260 68260 68260 0 68260 0 16 [sftp://[::]:2060/dropbox/test1.dat]

Jul 25 09:56:39 datapower xi50-opsSyslog [latency][info] mpgw(opsSftpExmFrontGateway): trans(944752)[10.1.131.205]: Latency: 0 1 0 0 0 0 0 1 1 1 13 13 0 1 0 1 [sftp://[::]:2060/dropbox/;type=d]

I'm struggling with breaking out the 16 individual fields. Any suggestions would be greatly appreciated.

Re: Can't Extract Multiple Custom Fields

David — Mon, 01 Aug 2011 23:45:59 GMT

What I would probably do is, in a search string, add:

| rex field=_raw "Latency: (?<Field1>\d*) (?<Field2>\d*) (?<Field3>\d*) (?<Field4>\d*) (?<Field5>\d*) (?<Field6>\d*) (?<Field7>\d*) (?<Field8>\d*) (?<Field9>\d*) (?<Field10>\d*) (?<Field11>\d*) (?<Field12>\d*) (?<Field13>\d*) (?<Field14>\d*) (?<Field15>\d*) (?<Field16>\d*)" | table Field1 Field2 Field3 Field4 Field5 Field6 Field7 Field8 Field9 Field10 Field11 Field12 Field13 Field14 Field15 Field16

You can also put the first part in your props.conf, via:

[SourceType]
EXTRACT-SixteenFields = Latency: (?<Field1>\d*) (?<Field2>\d*) (?<Field3>\d*) (?<Field4>\d*) (?<Field5>\d*) (?<Field6>\d*) (?<Field7>\d*) (?<Field8>\d*) (?<Field9>\d*) (?<Field10>\d*) (?<Field11>\d*) (?<Field12>\d*) (?<Field13>\d*) (?<Field14>\d*) (?<Field15>\d*) (?<Field16>\d*)

And then it will be automatically extracted for you.

topic Can't Extract Multiple Custom Fields in Splunk Search

Can't Extract Multiple Custom Fields

Re: Can't Extract Multiple Custom Fields