Splunk Search

Help with transforms

ericrobinson
Path Finder

Hello, I have been using splunk for about 6 months and continue to be amazed at what the product can do..

Anyway, I need some help with writing a Transform. I have been using field extractions for a while, but as I suspected, there appears to be a better way.

Here is the scenario, I have several stats that I need to pull out of the log.

An example:

2010-08-23 13:27:40,593 [xxxx]: INFO  StatEntry - line: 192 - [STAT] { receive-xxxx 323.0 { on queue 000.0 } { run 323.0 { ERPOC-updateFIXMessageAsProcessed() 323.0 { ERPOC-fetchFIXMessage() 003.0 } { ERPOC-updateFIXMessage() 103.0 } { ERPOC-fetchFIXMessage() 002.0 } { ERPOC-updateFIXMessage() 106.0 } { ERPOC-fetchFIXMessage() 002.0 } { ERPOC-updateFIXMessage() 105.0 } } } }

Is there a way for me to write one Transform via the manager to get all of these fields and their respective values?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Not via the Manager UI, but certainly via the config files:

props.conf:

[mysourcetype]
REPORT-extractmystats = extractmystats

transforms.conf

[extractmystats]
REGEX = \{\s*([\w-]+)(?:\(\))?\s+([\w\.-]+)
FORMAT = $1::$2
MV_ADD = true

seems will probably do close to whatever you want, although you don't explicitly say what exactly you are trying to pull out and how, or what you want to do with the data. Note that it will create some fields in a single event as multivalued fields.

ericrobinson
Path Finder

Thank you for your comment.. I was actually able to succedd using the manager. My regex was good.. I just nelgected to create an associated field extraction using the new transform. I had thought the transform was enough. As soon as I added a field extraction calling out the transform, I can see the values.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...