topic Re: How to extract several fields? in Splunk Search

How to extract several fields?

tpaulsen — Wed, 09 Jun 2010 22:03:07 GMT

Hello

we need to extract a lot of fields from the following log:

Example deleted.

What would be the best way to extract the fields?

We tried this:

props.conf

[TEST.log]
REPORT-TEST.log = transform-TEST.log

transforms.conf

[transform-TEST.log]

Deleted due to request

which is working just fine on Splunk 3, but on our Splunk 4 installation it sometimes doesn´t assign the correct values, especially the lines with the value "AxxxxxY" in it.

How do we have to change the transforms.conf so that it also works on Splunk 4?

What other options do we have?

Re: How to extract several fields?

gkanapathy — Wed, 09 Jun 2010 22:09:59 GMT

I'm not sure why you have $0 in there. But it would be a lot easier to do:

[transform-test-kubis.log]
DELIMS = " "
FIELDS = request_date,request_time,duration,request_from,method,ws_method,
# etc...

I'm also not so sure about how field names with - in them (vs _) work. They should work, but I would try changing those if there are still problems.

Re: How to extract several fields?

tpaulsen — Wed, 09 Jun 2010 22:57:14 GMT

Thank you, that looks promising.
There is still a little problem. Some entries (the ones with APP-KUSY) are one field shorter. How will Splunk handle those? As said, in 3 it wasn´t a problem, in Splunk 4 fields are wildly filled.

Re: How to extract several fields?

tpaulsen — Wed, 09 Jun 2010 23:08:02 GMT

Sorry, not working.

Re: How to extract several fields?

gkanapathy — Thu, 10 Jun 2010 07:42:14 GMT

are all the spaces spaces, or are some of them tabs, in which case, use DELIMS = " \t".

Re: How to extract several fields?

tpaulsen — Thu, 10 Jun 2010 20:16:18 GMT

Yes thank you! Works like a charm...as long as the log events have the exact same count of fields.

Re: How to extract several fields?

ftk — Thu, 23 Dec 2010 22:58:54 GMT

This questions loses a lot of its value to the community without the examples, since the answers provided won't make as much sense as they do with the examples. Please consider adding the examples again, perhaps you can just censor them rather than remove them completely.

Re: How to extract several fields?

tpaulsen — Fri, 21 Jan 2011 00:37:12 GMT

sorry, i had to remove the data due to security requests. Maybe simply delete the whole entry then, please?