topic Re: field extractor help in Splunk Search

field extractor help

a212830 — Wed, 07 Aug 2013 02:38:20 GMT

Hi,

I need to extract some fields via field extractor. I got most of them, but it is ignoring the ones that have decimal places. I want to grab the 5th field. The extract is as follows:

(?i)|.*?|(?P\d+)(?=|)

Here's some sample data:

375839600000|330128|NormalizedCPUInfo|Utilization|2|CPU|deviceA|HP H3C CPU

1375839600000|330571|NormalizedCPUInfo|Utilization|10|CPU|DEVICEB|HP H3C CPU

Can anyone help?

Re: field extractor help

grijhwani — Wed, 07 Aug 2013 03:00:02 GMT

The answer is very simple: "d+" only allows for one or more digits, and a decimal point is not a digit.

Re: field extractor help

a212830 — Wed, 07 Aug 2013 03:24:22 GMT

Thanks. Caught it! Duh.

Re: field extractor help

kristian_kolb — Wed, 07 Aug 2013 07:53:55 GMT

I would recommend to use the props/transforms approach using DELIMS and FIELDS. It's a little bit easier to handle stuff correctly. And you get all the fields extracted in one go.

props.conf

[your_sourcetype]
REPORT-blah = pipe_separated

transforms.conf

[pipe_separated]
DELIMS = "|"
FIELDS = field1, field2, field3, field4, field5, field6, field6, field7, field8

/Kristian

Re: field extractor help

grijhwani — Wed, 07 Aug 2013 11:29:15 GMT

Good solution to the broader unasked question.