Getting Data In

How do I create extractions where it can pick field names from the events See events below

puneetkharband1
Path Finder

I have 2 types of logs from one source where I need to map fields vs values ...I dont want to create complex regex as they are from structured data so how do I create fields and values from events 

May 27 07:51:49 TESTHOSTTEST TESTDEVTEST_11.2.0.125: User '' (root) : FAILED: Sign On, ID: 123220127, InstID: 7653, IPAddress: 111.222.213.238, FolderID: 0, Username: root, AgentBrand: TEST DEV SSH, AgentVersion: 11.2.0.0, DEVSize: 0, Error: 2976, Message: Failed to sign on: This IP address has been locked out.

May 27 07:51:34 TESTHOSTTEST TESTDEVTEST_11.2.0.125: User 'BLA BLA DI' (ei4o2f18pcsuo5tp) : Download File, ID: 123220102, InstID: 7653, IPAddress: 333.222.231.94, FileID: 770879833, FileName: 16680_Signup Detail_20210527 01-49-18-86.csv, FolderID: 472070079, FolderPath: /Home/test/TestWorks/Enhanced Affiliate Signup Reports, Username: TEST, AgentBrand: Chrome Browser, AgentVersion: 90.0.4430.212, DEVSize: 739698, Parm2: 0, Error: 0

Labels (3)
0 Karma

aasabatini
Motivator

Hi @puneetkharband1 

expand your event and select event actions > extract fields

aasabatini_0-1622181336243.png

it's will open another page like this, please select delimiters and click next

aasabatini_1-1622181445975.png

here select the delimiters other and insert ":" and  modify your name fields

aasabatini_2-1622181599585.png

 

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

puneetkharband1
Path Finder

this doesnt work I tried delimiter option.

0 Karma

aasabatini
Motivator

Hi @puneetkharband1 

are your sure that logs are structured data?, like as you shared looks like not structured, anyway  if are not structured you need to use mandatory the regular expression.

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

puneetkharband1
Path Finder

if you see there is one pattern and these logs are generated from a tool(Xfer) and only 2 types of logs are there which I posted.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...