How to extract multiple fields at a time from Eloquence fwaudit logs?

[jameslitt]

Hello

I'm attempting to extract multiple fields at a time from eloquence db fwaudit logs, an example of which is below:

timestamp: 2016-12-08 12:04:38
  ORDER-NO              : +XXXX
  CUST-NO               : X
 -CC-DOLLARS            : XXX
 +CC-DOLLARS            : XXX
  CREDIT-CARD-NO        : "X"
  CC-EXPIRE-DATE        : "X"
  ORDER-DATE            : +XXXXXX
  BILLING-TYPE          : "X"
  BILL-ISSUE-NO         : "\000\000"
  POSTED-DATE           : +XXXXXX
  POSTED-TIME           : +XXXXXX
  BILL-DATE             : +XXXXX

I have tried field extraction through the Splunk Web wizards, both the regular expression and delimiters options. But the problem with that is you have to define the fields, where as with this there are multiple fields at a time (I'd want to extract whatever fields have "+" and "-" at the beginning) and the fields themselves can vary from log to log.

I have installed Splunk Common Information Model (CIM) hoping that may help but no luck, there is also no existing eloquence app which I hoped would help with field extraction.

Any suggestions I can work from? Thanks

[gokadroid]

If you want to catch the fields having values starting with +/- try this if you only want to list them:

your query to return the events
| rex field=_raw max_match=0 "(?<field_name>[\S]+)\s*?\:\s*?(?<field_value>(\+|\-)[\S]+)"
| table field_name, field_value

If you want then to be separate fields try something ike this:

your query to return the events
| rex field=_raw max_match=0 "(?<field_name>[\S]+)\s*?\:\s*?(?<field_value>(\+|\-)[\S]+)"
| eval myFields=mvzip(field_name, field_value, "~")
| mvexpand myFields
| rex field=myFields "(?<myFieldName>[^\~]+)~(?<myFieldValue>.*)"
| table myFieldName, myFieldValue

If you want to search on any of the above fields then you can use | search myFieldName="stringValue" or somethign like |search myFieldValue="stringValue". For example if you want to search all the fieldNames starting with a +/- like -CC-DOLLARS or +CC-DOLLARS then you can try to append this right at then:

| search myFieldName="\+*" OR myFieldName="\-*"

[jameslitt]

Hi, thanks for your reply! I am getting some results back for this, however not everything I would like.

To clarify I'm looking for only the results on the left hand side with a "+" or "-", essentially the field names rather than the field results.

Would you be able to help further please? I'm completely new to regular expression and its all going over my head. Are there any resources on regex you would recommend I look at?

Thanks again