Archive

Help with transforms

Path Finder

Hello, I have been using splunk for about 6 months and continue to be amazed at what the product can do..

Anyway, I need some help with writing a Transform. I have been using field extractions for a while, but as I suspected, there appears to be a better way.

Here is the scenario, I have several stats that I need to pull out of the log.

An example:

2010-08-23 13:27:40,593 [xxxx]: INFO  StatEntry - line: 192 - [STAT] { receive-xxxx 323.0 { on queue 000.0 } { run 323.0 { ERPOC-updateFIXMessageAsProcessed() 323.0 { ERPOC-fetchFIXMessage() 003.0 } { ERPOC-updateFIXMessage() 103.0 } { ERPOC-fetchFIXMessage() 002.0 } { ERPOC-updateFIXMessage() 106.0 } { ERPOC-fetchFIXMessage() 002.0 } { ERPOC-updateFIXMessage() 105.0 } } } }

Is there a way for me to write one Transform via the manager to get all of these fields and their respective values?

0 Karma

Splunk Employee
Splunk Employee

Not via the Manager UI, but certainly via the config files:

props.conf:

[mysourcetype]
REPORT-extractmystats = extractmystats

transforms.conf

[extractmystats]
REGEX = \{\s*([\w-]+)(?:\(\))?\s+([\w\.-]+)
FORMAT = $1::$2
MV_ADD = true

seems will probably do close to whatever you want, although you don't explicitly say what exactly you are trying to pull out and how, or what you want to do with the data. Note that it will create some fields in a single event as multivalued fields.

Path Finder

Thank you for your comment.. I was actually able to succedd using the manager. My regex was good.. I just nelgected to create an associated field extraction using the new transform. I had thought the transform was enough. As soon as I added a field extraction calling out the transform, I can see the values.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!