All Apps and Add-ons

How to add regex to transforms.conf

chamil3001
Explorer

Hi,
I have some data like this.

D HE122013032521002200GTB27000780000100108 00000000030008110000081100000 640001
D HE122013032521002200GTB27000780000100108 00000000030008110000081100000 640001
D HE122013032521002200GTB27000780000100108 00000000030008110000081100000 640001
D HE122013032521002200GTB27000780000100108 00000000030008110000081100000 640001
D HE122013032521002200GTB27000780000100108 00000000030008110000081100000 640001

I have to extract the fields from these. but the problem is IFE cannot extract as i want to.
cuz the fields are like this. have to extract them one by one. I don't know that much REGEX.

D
HE12
20130325
21002200
GTB27000
etc
etc

Please help.
I think i have to manually edit tranforms.conf and props.conf to do the translations right?

Thanks in advance

Chamil

0 Karma

kristian_kolb
Ultra Champion

If your log is really like that, with fixed-length fields concatenated together (mostly) without whitespace between them, you can do a props.conf only extraction, like so;

[your_sourctype]
EXTRACT-blah = (?<field_name1>\w{1})\s(?<field_name2>\w{4})(?<field_name3>\d{6})(?<field_name4>\d{6})(?<field_name5>\w{8})

etc etc

field_name1 (rename it as you please) would contain the first character \w{1}
then the space/tab is skipped \s
field_name2 would contain the next 4 characters \w{4}
field_name3 would contain the next 6 digits \d{6}
etc etc

Hope this helps,

Kristian

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>