All Apps and Add-ons

Can fields within requests be extracted via transforms.conf?

jwalzerpitt
Influencer

Has anyone extracted requests via the transforms? Here is a request:

request="
              GET /poormanscron/run-cron-check HTTP/1.1\r\n
              Host: x.y.edu\r\n
              Connection: keep-alive\r\n
              Accept: */*\r\n
              X-Requested-With: XMLHttpRequest\r\n
              User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102    Safari/537.36\r\n
              Referer: https://x.y.edu/financial-assistance\r\n
              Accept-Encoding: gzip, deflate, sdch, br\r\n
              Accept-Language: en-US,en;q=0.8\r\n
              Cookie: SESS0764812227b85da9e7ceb1311b5f950e=38v7r59t6scm9l02geuthpc5u7; TS01f58e10=0134f538f1e08d9f9d835b438c8361643992f8dc5a4d270d8e1652970585e3345f954dbc6da74b8946acd7b38a6e8dc63931106a31; TS018c07de_77=0838ed4c3cab28005afebacfed6da5eda6d3b209abd823273aa05738bdb18bf4c560496fb71daf3170ad3ebc28ccf0ab0828c52475823800599c3b63a9af76589385764d9c42d62f69e62745f94bf7b339537549fdac65782526adf6584fb5e8dce96e5ba1b8241d24b13014e5029c14; TS018c07de=0134f538f1e026a86801ef06f832b83fef8a674a7f899a706c4086919c209142555e93a47f; has_js=1\r\n
              If-Modified-Since: Thu, 09 Jun 2016 19:49:28 GMT\r\n
              \r\n
",

Wondering if the fields within the request can be extracted via transforms, or if these have to be extracted manually?

Thx,
Jeff

0 Karma

woodcock
Esteemed Legend

Anything that you can build a RegEx for can be made an automatic extraction. Build it manually with rex first and then translate it to props.conf and transforms.conf.

0 Karma

jwalzerpitt
Influencer

Thx for the reply

0 Karma

woodcock
Esteemed Legend

You can build with regex101.com first, to make it easier.

0 Karma

sundareshr
Legend

You should be able to extract using the field transformations ui

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms

0 Karma

jwalzerpitt
Influencer

Thx for the reply

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...