Getting Data In

Extract field values

Contributor

Hi, I have having the following stanza in transforms.conf

[apache_fields]
DELIMS = "\t"
FIELDS = clientip,remotelogname,user_id,timestamp,resource_requested,http_status_code,content_length,referrer,user_agent,response_time

clientip field value could be 1 or 2 IP separated by comma
10.39.127.164
10.39.127.164, 10.183.135.2

Is it possible to add another stanza so I can extract ip1 and ip2 if it exists.

Thanks in advance!

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Have you considered replacing the DELIMS and FIELDS statements with a REGEX? For example:

[apache_fields]
REGEX = (?<ip1>.*?)(,\s(?<ip2>.*?))?\s(?<remotelogname>.*?)\s(?<user_id>.*?)\s(?<timestamp>.*?)\s(?<resource_requested>.*?)\s(?<http_status_code>.*?)\s(?<content_length>.*?)\s(?<referrer>.*?)\s(?<user_agent>.*?)\s(?<response_time>.*)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Have you considered replacing the DELIMS and FIELDS statements with a REGEX? For example:

[apache_fields]
REGEX = (?<ip1>.*?)(,\s(?<ip2>.*?))?\s(?<remotelogname>.*?)\s(?<user_id>.*?)\s(?<timestamp>.*?)\s(?<resource_requested>.*?)\s(?<http_status_code>.*?)\s(?<content_length>.*?)\s(?<referrer>.*?)\s(?<user_agent>.*?)\s(?<response_time>.*)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Contributor

Thank you. This works!

0 Karma

Contributor

yes, the delimiter is comma. I tried to add a new stanza below but it didn't work out. Thank you!

[clientip]
DELIMS = ", "
FIELDS = aip1, aip2

0 Karma

Super Champion

So, there is white space for a delimiter, but only a comma between the IPs?

0 Karma