topic Field Extraction in Splunk Search

Field Extraction

carmackd — Thu, 12 Aug 2010 02:03:50 GMT

I have a log file that looks like this:

Wed Aug 11 14:27:48 GMT 2010 | Inactive Users Last 7 Days---> | 123456789 | 321654987 | 489756123 | 111000555

Wed Aug 12 14:20:18 GMT 2010 | Inactive Users Last 7 Days---> | 123456789 | 321654987 | 489756123 | 111000555 | 222211145 | 789789741

Basically I want to extract this into three fields, timestamp, range, and userID. Currently I'm using a transform with a "|" deliminator. The problem is, this is only getting the first userID, not the ones that follow. keep in mind, each event can have different amounts of userID's. For example, the first event has 4 userID's, and the second has 6 userID's, another could have 20. I want to extract them all into a single field.

Re: Field Extraction

hbazan — Thu, 12 Aug 2010 04:18:39 GMT

I almost got it:

| rex field=raw "Inactive Users Last 7 Days--->(?<users>.*)" | eval user=split(users," | ") | top user

But, there's a empty user value. Get rid of that and you're done.

Re: Field Extraction

twinspop — Thu, 12 Aug 2010 04:28:21 GMT

rex with max_match?

| rex field=_raw "\|(?<users>[0-9]+)" max_match=100

That should result in a users multi-valued field. (With a max of 100 users contained therein.)