All Apps and Add-ons

Splunk DB Connect 2.3.0: How to properly extract fields from database events that contain spaces in the field names?

bharathkumarnec
Contributor

Hello All,

We are using Splunk DB Connect 2.3.0. Below are the sample of events:

Severity Code = "103",Transition Code="111"

"Severity Code" & Transition Code" are not showing in the fields list. Instead, we are able to see only fields with name "Code", as there is a white space in between the two words of the field names.

How to extract fields completely with "Severity Code" & "Transition Code"?

Kindly help me out.

Regards,

0 Karma

rodrigorsilva
Communicator

It would be simpler to adjust the input, avoid writing a regex...

Example: Select `Severity Code` as Severity_Code, `Transition Code` as Transition_Code from [your_table] ...

Tks

Rodrigo Ribeiro

0 Karma

bharathkumarnec
Contributor

We have not explicitly specified sourcetype for these events, our db connect app configured in Search head server.

If we need to specify the sourcetype, what all we need to include and this sourcetype stanza should be in searchhead, indexer or both??

Thanks for your help!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's a Splunk Best Practice to explicitly specify a sourcetype for all inputs. It should be defined on the node where DB Connect is running. Choose the best props.conf settings for your data. If you elect to use REGEX string, this one may get you started: Severity Code = "(?<severity>\d+)",Transition Code="(?<transition>\d+)".

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What sourcetype are you using and what are the props.conf settings for that sourcetype?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...