topic Re: Header extraction rename in Splunk Search

Header extraction rename

ShaneNewman — Wed, 12 Feb 2014 00:49:39 GMT

I am monitoring several BizTalk\MSMQ perfmon counters (Host Counters, General Counters, MSMQ Queue, MSMQ Service). I have setup field extraction based on the header row of this file, and it is garbage! For the General Counters, I was able to setup a transform in the props.conf to rip out the header and setup field extraction via KV because the column names never change. For the other 3, that is not the case.

Is there a way to setup some sort of regular expression to dynamically extract field names based on the header row?

Example:

"\\hostname\BizTalk:Message Box:Host Counters(HOST_COUNTER_NAME:biztalkmsgboxdb:HOSTNAME.test.test.net,56219)\Host Queue - Number of INSTANCES"

Becomes -> host_counter_name_instances

I have CAPITALIZED the location of the identifiers I need in the default header.

Re: Header extraction rename

ShaneNewman — Wed, 12 Feb 2014 00:59:17 GMT

I know the regex to do the field extractions to create the name I want it to be.

I cannot find it documented anywhere if there is a way to dynamically create field names from the header row without indexing it - other than just using what the header row has in it to begin with...

Re: Header extraction rename

ShaneNewman — Fri, 21 Mar 2014 01:38:08 GMT

I turned on the counters in WMI, then used the wql tool in Splunk to capture the data. Not idea but it did the job perfectly.