topic Dynamic field name extration in Splunk Search

Dynamic field name extration

ninisimonishvil — Tue, 29 Sep 2020 18:16:28 GMT

Here is the data :

"app": "https", "purpose": "bypass", "direction": "outbound", "int64gapps": "0" }, { "app": "https", "purpose": "inspect", "direction": "outbound", "int64gapps": "0" }, { "app": "http", "purpose": "bypass", "direction": "outbound", "int64gapps": "0" }, { "app": "http", "purpose": "inspect", "direction": "outbound", "int64gapps": "0"

And here is regex: \"app":\s\"(\w*)",\s"purpose":\s\"(\w*)",\s"direction":\s"\w*",\s"int64gapps":\s"(\d*)"

I have 3 groups and as a Format I want it to use Group 1 and 2 as a Field name and group 3 as a value. so my FORMAT= $1.$2::$3

TRANSFORMS.conf
[Bandtest]
REGEX=(\"app":\s\"(\w*)",\s"purpose":\s\"(\w*)",\s"direction":\s"\w*",\s"int64gapps":\s"(\d*)")
FORMAT=$1.$2::$3
WRITE_META = True

PROPS.cong
[radware_api_stat]
TRANSFORMS-Bandtest = Bandtest

I need SPlunk to extract field names httpbypass and httpinspect, it only extracts the first one. in short I need it to get multiple field names per event using the same regex, is this function available?

Re: Dynamic field name extration

FrankVl — Wed, 28 Feb 2018 13:08:02 GMT

Is it just me, or are you processing multiple events as 1 and using field values as field names?

Does this have to be extracted at index time?

Perhaps simpler to just extract the actual fields and their values and then create some calculated fields off of those to club things together as you are describing here? But still a bit confused about the context to be honest...

Re: Dynamic field name extration

ninisimonishvil — Tue, 29 Sep 2020 18:13:46 GMT

now I have changed it to REPORT but another issue
I have two groups and in Format I want to concatenate values FORMAT=handrej_Client_outbound::$1.$2 where first grouping is a sentence and second number.

is there any special syntax for that?