topic Re: Newbie Splunk Field Extraction Question in Splunk Search

Newbie Splunk Field Extraction Question

jcman01 — Mon, 15 Oct 2012 18:23:50 GMT

I have a log entry that looks like this. I am talked with coming up with a quick-and-dirty financial report to report net sales. Can someone tell me where to start doing this? Do I build a report and use field extraction? The values I want to look for are, or course, "Net Sales", and then capture the dollar amound after that. I would like to just get a list of the

ThreadName=Thread-2;|12:26:21,680  INFO OrderController:126 - Net sales per order: 362.15

Re: Newbie Splunk Field Extraction Question

RicoSuave — Mon, 15 Oct 2012 18:38:14 GMT

The easiest way to extract that field will be to use the rex command in search. This should give you what you want:

<yoursearch> | rex field=_raw "order:\s(?<netsales>\d+.?\d+)"

That should extract that dollar amount into a field called netsales. This is assuming that the dollar amount is always preceded by order:

Re: Newbie Splunk Field Extraction Question

dmaislin_splunk — Mon, 15 Oct 2012 20:46:49 GMT

You can make that a permanent field extraction by selecting the specific event and building the extraction with the extract fields from the pull down next to each log line or you can:

create a props.conf for that sourcetype and in it put this in it:

props.conf
[YOURSOURCETYPE]
EXTRACT-myextraction = order:\s(?\d+.?\d+)

create a props.conf and a transforms.conf

props.conf
[YOURSOURCETYPE]
REPORT-myextraction = myfieldextraction

transforms.conf
[myfieldextraction]
REGEX = order:\s(?\d+.?\d+)

Re: Newbie Splunk Field Extraction Question

ptanner — Tue, 16 Oct 2012 10:44:03 GMT

This usually works. However, it wouldn't extract anything with an input like

ThreadName=Thread-2;|12:26:21,680 INFO OrderController:126 - Net sales per order: 3

since the regex asks for at least two digits. Also, you need to escape the point. Maybe something like this would be better:

| rex field=_raw "order:\s+(?\d+(?:\.\d+)?)"

This allows for an arbitrary number (>0) of whitespaces.