Building for the Splunk Platform

how to save fileds permanently after extract command


Hello All,

I have the below string

2020-04-24 23:14:47,422 INFO http-8080-1 com.pscu.dxsimple.raApp - Response (Success:true)-(Validation:true)-(F_TAG:1402)-(CLIENT_ID:2113)-(Total_TT:4046ms)-(AppServer_TT:3419ms)

I need to extract the key value pairs that are "(Success:true)-(Validation:true)-(F_TAG:1402)-(CLIENT_ID:2113)-(Total_TT:4046ms)-(AppServer_TT:3419ms)" as specific fields.

I used index=testindex source="tomcat.txt"| extract pairdelim="\"{-}" kvdelim=":"

I am able to see the keyvalue being generated but i need to have this data persistant and saved permanently. How can i do this?

Please help

Tags (1)
0 Karma


You can use inline field extraction. Add below configuration in props.conf. Fields are extracted whenever you search source=tomcat.txt. You can also use a sourcetype name in place of source name.


EXTRACT-myfields = \(Success:(?<Success>\w+)\)-\(Validation:(?<Validation>\w+)\)-\(F_TAG:(?<F_TAG>\w+)\)-\(CLIENT_ID:(?<CLIENT_ID>\w+)\)-\(Total_TT:(?<Total_TT>\w+)\)-\(AppServer_TT:(?<AppServer_TT>\w+)\)
0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...