topic Tried DELIMS, REPORT but cannot get neither working in Splunk Search

Tried DELIMS, REPORT but cannot get neither working

Esky73 — Wed, 08 Feb 2017 13:37:10 GMT

sample data :

Number: 152119522
Date : 12/01/2015 12:00:00 AM, Execution Time: 1945
Area Code: 21
Area Name: reading
Road: 7789
Code: 230
Description: Backup Failed

I have successfully - managed to extract required fields individually but trying to do it another way using the colon as a delimiter but i cannot get it working - config files :

props.conf

[sourcetype]
TRANSFORMS-colons = colons
transforms.conf
 [colons]
 REGEX = (?<_KEY_1>\w+):\s+(?<_VAL_1>\S+)

where am i going wrong - cheers.

Re: Tried DELIMS, REPORT but cannot get neither working

gvmorley — Fri, 10 Feb 2017 06:26:12 GMT

Hi there,

This should be possible. I have a go with your data using this in props.conf:

[test-ext]
TRUNCATE = 0
SHOULD_LINEMERGE = false
LINE_BREAKER = (NULL)
DATETIME_CONFIG = CURRENT
MAX_EVENTS = 100000
REPORT-test-ext = sourcetype-test-ext

You'd need to change the TRUNCATE, MAX_EVENTS and LINE_BREAKER to whatever works best for you. This was just for a quick test.

Also, if you want to use the Date from your data as the Index time, then take a look at the TIME_PREFIX and TIME_FORMAT options.

Then in transforms.conf:

[sourcetype-test-ext]
REGEX = ([^:]+):\s([^\r\n,]+)
FORMAT = $1::$2

Which gives me this in Splunk:

Hopefully that gets you closer to what you're looking for.

Re: Tried DELIMS, REPORT but cannot get neither working

Esky73 — Wed, 08 Mar 2017 05:06:27 GMT

thanks for your help