Extract Data with Field Definition

[ciscotek9]

How would you extract particular info from raw data that is not defined by a field and then add it to a new field?

The name of databases being sent to logs all end in *db but can appear randomly in the raw data.

We want to pull them from raw data put them in column by themselves named "Database" with the corresponding raw data line that it appears in.

95% of the databases named end in "*db". A few are one offs but when we can find the solution for the ones that end in *db hopefully the answer will come.

[kristian_kolb]

Well, one thing to try is to use rex to extract the name as a field. If this works fine, you can then make it permanent by making the changes in props.conf (or via IFX).

Consider these sample events;

"The quick brown fox-db jumps over the lazy dog"
"All work and no play makes Jack a dull boydb"
"Crane-db, the most powerful tool at the building site" 

To extract the database-strings from these type of events, you might try;

...| rex "(?<my_db>\S+db)" | table my_db

and the output would be;

my_db
-----
fox-db
boydb
Crane-db

Please provide a few sample events if you want more qualified advice.

[lukejadamec]

Can you post some examples of the logs, and point out what you mean by 'raw data line'?