Getting Data In

Is it possible to create an event type field within a source type?

jorell
New Member

Hi,

I was wondering if it was possible to create a field within the source type that would show the event type.

Here is a record from my log:

2016-06-05T19:55:10,144  INFO LoadProperties:225 - LoadProperty - Initial fetch for properties is successful

I would like to have INFO (and other types, like ERROR, WARN etc) as their own field within the source type. How can I do this? I'm new to Splunk and am currently using Splunk Enterprise 6.4.

0 Karma

sundareshr
Legend

Use the field extractions page to extract fields by sourcetype. Here's docs on that. http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Managesearch-timefieldextractions

Once in IFX, chose to write your own regular expression and enter this. Make sure you set the right permissions, after creating the field.

,\d+\s*(?<type>\w+)

*OR*

(?<type>INFO|WARN|DEBUG|ERROR)
0 Karma

Raghav2384
Motivator

Hello @jorell, could you please more info? What i understand is you are looking to create a filed that will hold the INFO,ERROR and WARN values? Is that what you are looking for?

You can extract fields always using regular expressions and eval: https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Extractfieldswithsearchcommands.

Just to give you an idea, i extracted the Value INFO and assigned it to the Key = Level(Log Level)

|gentimes start=-1|eval Event="2016-06-05T19:55:10,144 INFO LoadProperties:225 - LoadProperty - Initial fetch for properties is successfu"|rex field=Event "\s(?P\w+)\s"

Please provide more info with an example if this is not even close to what you're looking for.

Hope this helps!

Thanks,
Raghav

0 Karma

jorell
New Member

Each Log has a type of warning it is after the timestamp, as you've seen. I just want to be able to search for anything that is of the ERROR type, or of the WARN time. So, anyway I can do that will be fine. There is a comma, a number than the log type, which in my example is INFO.

0 Karma

jorell
New Member

Thanks for the speedy reply, btw

0 Karma

Raghav2384
Motivator

np 🙂 Please provide sample events with all possible patterns and we will help you with the dream extraction 🙂

Thanks,
Raghav

0 Karma
Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...