https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111378#M29180 <P>You could use the <STRONG>Interactive Field Extractor</STRONG> to do this</P> <OL> <LI>Go to the event</LI> <LI>Click "Event Actions"</LI> <LI>Click "Extract Fields"</LI> <LI>Copy examples of the fields you want from your data into the examples box</LI> <LI>Test generated regex, edit as needed. </LI> <LI>Save as field extraction</LI> </OL> <P>See this <A href="http://docs.splunk.com/Documentation/Splunk/6.1.5/Knowledge/ExtractfieldsinteractivelywithIFX">guide</A> (for 6.1). </P> <P>Note this process becomes <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/ExtractfieldsinteractivelywithIFX">significantly easier in 6.2.</A></P> Wed, 12 Nov 2014 17:42:00 GMT aljohnson_splun 2014-11-12T17:42:00Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111377#M29179 <P>I have a log that has the following:<BR /> Blah blah bloh HandleBusInfoMessage=31951592=460892.509; nextcommand Blah HandleSomethingElse=31951592=460892.509 Blah ...</P> <P>I want to extract the following:<BR /> HandleBusInfoMessageCount=31951592<BR /> HandleBusInfoMessageTime=460892.509</P> <P>HandleSomethingElseCount=31951592<BR /> HandleSomethingElseTime=460892.509</P> <P>The command name (Handle*) can be variable.<BR /> Thanks for the help in advance.</P> Wed, 12 Nov 2014 17:37:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111377#M29179 mfscully 2014-11-12T17:37:32Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111378#M29180 <P>You could use the <STRONG>Interactive Field Extractor</STRONG> to do this</P> <OL> <LI>Go to the event</LI> <LI>Click "Event Actions"</LI> <LI>Click "Extract Fields"</LI> <LI>Copy examples of the fields you want from your data into the examples box</LI> <LI>Test generated regex, edit as needed. </LI> <LI>Save as field extraction</LI> </OL> <P>See this <A href="http://docs.splunk.com/Documentation/Splunk/6.1.5/Knowledge/ExtractfieldsinteractivelywithIFX">guide</A> (for 6.1). </P> <P>Note this process becomes <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/ExtractfieldsinteractivelywithIFX">significantly easier in 6.2.</A></P> Wed, 12 Nov 2014 17:42:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111378#M29180 aljohnson_splun 2014-11-12T17:42:00Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111379#M29181 <P>One thing I need to add is that the command name (Handle*) can be variable so I would need to rex it I would assume. </P> Wed, 12 Nov 2014 18:04:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111379#M29181 mfscully 2014-11-12T18:04:39Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111380#M29182 <P>One thing I need to add is that the command name (Handle*) can be variable so I would need to rex it I would assume. </P> Wed, 12 Nov 2014 18:19:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111380#M29182 mfscully 2014-11-12T18:19:36Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111381#M29183 <P>After you use the field extractor, you can edit the regex that is generated so that it can accommodate any of the values that might be seen. e.g. <CODE>[\w\d_+]</CODE> instead of where it might have generated "Handle". Then you can retest the extraction, and repeat until its perfect.</P> Wed, 12 Nov 2014 18:30:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-complex-field/m-p/111381#M29183 aljohnson_splun 2014-11-12T18:30:46Z