topic Field extraction windows sources in Splunk Search

Field extraction windows sources

Josh — Sat, 21 Aug 2010 21:11:45 GMT

Hello All,

I am attempting to use props and tranforms to extract field values from the source field. the source is coming from a Windows machine. I am able to extract fields from source from Linux sources however doesnt seem to be working for me from Windows sources. I am guessing there is something wrong with the regex below, hoping someone can take a look.

From the below at search time I am expecting to see two fields avaialble: application=NetShimService port=9932

source:

C:\Program Files\DTS\remotelogging\logs\NetShimService\Logs\9932\BRAVO_TMS_DEV_MDS.log

tranforms.conf

[dtsAppName]
SOURCE_KEY = source
REGEX = C:\\\Program Files\\\DTS\\\remotelogging\\\logs\\\(?<application>.*)\\\Logs\\\?<port>[0-9].*\\\.*

props.conf

[applogs]
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = LOG_ENTRY
REPORT-dts = dtsAppName
TRANSFORMS-dtsremove = setNull

Re: Field extraction windows sources

zscgeek — Sat, 21 Aug 2010 22:27:42 GMT

Not sure why but my regex test tools did not like your regex. Try this to see if it works:

tranforms.conf

[dtsAppName]
REGEX = C:\\Program Files\\DTS\\remotelogging\\....\\(?<application>.+?)\\.ogs\\(?<port>\d+)\\.*

Re: Field extraction windows sources

gkanapathy — Sat, 21 Aug 2010 23:23:51 GMT

Your regex should be:

REGEX = (?i)C:\\Program Files\\DTS\\remotelogging\\logs\\(?<application>[^\\]*)\\Logs\\(?<port>\d*)\\

You were missing parentheses around the port capture group.
In regex, a \ (backslash) character should be escaped as \\ (two backslashes), not \\\ (three backslashes).
Not absolutely required, but you should make the regex case-insensitive when comparing against Windows paths with (?i).