topic How to extract fields depending on log message type? in Splunk Search

How to extract fields depending on log message type?

dotandvir — Mon, 28 Sep 2020 18:00:45 GMT

Hi,

I have a log file consisting of log entries with the following format:
data time source message_type optional_qualifier param1, param2,...,param_n

The parameters value only (i.e. not of the type name=value). What would be the easiest way to extract parameter number 3 or 4 and assign them to a field?

Dotan

Re: How to extract fields depending on log message type?

Raghav2384 — Mon, 27 Oct 2014 15:12:42 GMT

Several ways to do it. Using Transforms.conf with delim option.
Or use ondemand rex. http://docs.splunk.com/Documentation/Splunk/6.1.4/Admin/transformsconf

Re: How to extract fields depending on log message type?

dotandvir — Tue, 28 Oct 2014 08:14:51 GMT

Thank you, do you have a step by step process for doing so? I am a bit confused about what needs to be done in what order.

Dotan

Re: How to extract fields depending on log message type?

Raghav2384 — Tue, 28 Oct 2014 21:28:59 GMT

In my Transforms.conf, this would be the entry
[MyStanza]
DELIMS = "|"
FIELDS = "F001","F002","F003"
And then,add ref in
Props.conf
[MyFields]
REPORTS-foo = MyStanza.

Results, you should have F001 = abc123, F002=cyz234 and so on....
Hope this is what you're looking for.

Thanks,
Raghav