topic Creating new Field Extractions in Splunk Search

Creating new Field Extractions

misteryuku — Fri, 30 Mar 2012 01:09:57 GMT

I have a set of log data in Splunk Search app contained in source=sampledata,sourcetype=sample.
field1,field2,field3 are new fields that i added through the recievers REST endpoint

3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry

host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1

3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry

host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1

3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry

host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1

Lets say if i want to extract the fields: field1, field2 & field3 at search time, so i configured the say i am going to create new field exractions in $Splunk_HOME/users/admin/search/local/props.conf (props config file for search app)

What is the regex expression to extract each of these fields at search time(extracting the key value pairs during search time)? I thought it would be something like [\^$.|?*+()].

Re: Creating new Field Extractions

hjwang — Fri, 30 Mar 2012 01:41:08 GMT

By default, Splunk will automatically extract the fields based on key=value format. the left of equal sign as field name and the right as its value.

Re: Creating new Field Extractions

misteryuku — Fri, 30 Mar 2012 01:53:45 GMT

Yeah. When i want to retrieve the results from the search as an XML through search/jobs/{search_id}/results endpoint the i want the field xml tags to have the new field names i have created.
For example i want to see something like this when i retrieve.

Happy

Re: Creating new Field Extractions

Ayn — Fri, 30 Mar 2012 05:58:08 GMT

You need to specify the fields you want to be returned in your search request. Do that, and the fields you want will show up.

Re: Creating new Field Extractions

misteryuku — Fri, 30 Mar 2012 06:04:54 GMT

As in the search commands?

Re: Creating new Field Extractions

Ayn — Fri, 30 Mar 2012 06:11:59 GMT

As a parameter in the API call. Specifically, the rf parameter. More info here: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearches#Tips_on_creating_searches

Re: Creating new Field Extractions

deepakmurthy — Sat, 24 May 2014 00:33:59 GMT

How to disable - extracting the fields based on key=value format in splunk, this is messing up my fields information, as i have defined columns in transform.conf file.