topic Re: Field Extraction - Parsing - Regex in Splunk Search

Field Extraction - Parsing - Regex

abhijitnayak — Tue, 22 May 2012 05:51:03 GMT

Hi Everyone,

I am trying to extract fields from the multivalued Field which has the following

http://pubads.g.doubleclick.net/gampad/ads?correlator=1329033559899&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&client=ca-pub-3341866503936280&slotname=Argaam_AllPages_LeaderBoard_728x90&page_slots=Argaam_AllPages_LeaderBoard_728x90&cookie=ID%3Dc8e744ff06435b06%3AT%3D1328766284%3AS%3DALNI_MZSu26hgR2sN5WOP8rB52YX_YtF5A&url=http%3A%2F%2Fwww.argaam.com%2FPortal%2FDefault.aspx&lmt=1329033560&dt=1329033560159&cc=100&oe=utf-8&biw=1920&bih=985&adk=3690209964&adx=460&ady=52&ifi=1&oid=3&u_tz=240&u_his=3&u_java=true&u_h=1080&u_w=1920&u_ah=1040&u_aw=1920&u_cd=24&flash=10.3.181.34&gads=v2&ga_vid=355700385.1328766284&ga_sid=1329023597&ga_hid=818285417&ga_fc=true

The parameters are usually separated by param="Value"

From the above text = GA_googleSetAdContentsBySlotForSync

Parameter = &callback
value = GA_googleSetAdContentsBySlotForSync

Parameter = &flash
value = 10.3.181.34

The text above is one field and this parameter extraction has to be done only to websites which are search engines ..

Is there a way to extract the field values even if it is not dynamic way of extraction?

Re: Field Extraction - Parsing - Regex

Ayn — Tue, 22 May 2012 06:25:10 GMT

I don't understand what's not working and how you would like things to work. Could you state your problem more clearly please?

Re: Field Extraction - Parsing - Regex

abhijitnayak — Tue, 22 May 2012 09:48:57 GMT

I am new to splunk. Can you please tell how to achieve this? I am unable to find the search query using splunk

| eval Field2=substr(message, charindex(message, "&lmt="), charindex(message, "&dt="))

I have used some thing as above but charindex doesnt work.

here "message" is the Field which is been extracted during the data import.

Re: Field Extraction - Parsing - Regex

abhijitnayak — Tue, 22 May 2012 09:50:24 GMT

Field2 that needs to be extracted is 1329033560.. can you please suggest the regex to derive this multi valued field?

Re: Field Extraction - Parsing - Regex

mikelanghorst — Wed, 23 May 2012 02:34:24 GMT

Did you look at all the fields, not just those shown on the left? Click Edit, and in the pop-up window that field should already be extracted as "correlator".

Splunk should automatically extract a value any time it sees a key=value. How it determines what are "interesting fields" I'm not sure.

Re: Field Extraction - Parsing - Regex

abhijitnayak — Wed, 23 May 2012 05:01:10 GMT

Hi Mike , I dont this its so easy .
We would have to parse and cut the words between &param1="WORD"&param2
Let me know if there is a way to do this.

Re: Field Extraction - Parsing - Regex

abhijitnayak — Mon, 28 May 2012 06:12:10 GMT

GOT IT!!!
source="POC.txt" | regex Field2="google" | makemv delim="&" Field2